second commit
This commit is contained in:
pvincent
Vendored
+8
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"recommendations": [
|
||||
"mads-hartmann.bash-ide-vscode",
|
||||
"mkhl.shfmt",
|
||||
"samuelcolvin.jinjahtml",
|
||||
"jgclark.vscode-todo-highlight"
|
||||
],
|
||||
}
|
||||
Vendored
+35
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"cSpell.words": [
|
||||
"chattr",
|
||||
"dnsmasq",
|
||||
"dpkg",
|
||||
"echoerr",
|
||||
"mkdir",
|
||||
"resolv",
|
||||
"rfkill",
|
||||
"tera"
|
||||
],
|
||||
"cSpell.enableFiletypes": [
|
||||
"!plaintext"
|
||||
],
|
||||
"ltex.language": "en",
|
||||
"outline.showVariables": false,
|
||||
"editor.formatOnSave": true,
|
||||
"todohighlight.enableDiagnostics": true,
|
||||
"todohighlight.include": [
|
||||
"**/*.js",
|
||||
"**/*.jsx",
|
||||
"**/*.ts",
|
||||
"**/*.tsx",
|
||||
"**/*.html",
|
||||
"**/*.css",
|
||||
"**/*.scss",
|
||||
"**/*.php",
|
||||
"**/*.rb",
|
||||
"**/*.txt",
|
||||
"**/*.mdown",
|
||||
"**/*.md",
|
||||
"**/*.sh",
|
||||
"**/scripts/*"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,661 @@
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
zourit-admin
|
||||
Copyright (C) 2021 zourit
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published
|
||||
by the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
@@ -1,5 +1,5 @@
|
||||
MIAOU SERVER
|
||||
============
|
||||
MIAOU
|
||||
=====
|
||||
|
||||
provisioning tool for building opinionated architecture following these principles:
|
||||
* free software: AGPLv3
|
||||
@@ -14,12 +14,10 @@ TODO
|
||||
* [ ] less interactive command
|
||||
* [ ] on lxd init during then install process
|
||||
* [ ] backup postgresql missing out on **saturday**
|
||||
* [ ] TOOLBOOX/nc (as binary)
|
||||
* [ ] nginx root domain redirects
|
||||
* [ ] update dnsmasq as well
|
||||
* [ ] TOOLBOOX/nc (binary)
|
||||
* [ ] final ansible-like indicators: same/new
|
||||
* [ ] patched editor (backup+editor+diff+patch)
|
||||
* [ ] improve log journal for each `recipe` (apache, for example) in order to shorten disk space
|
||||
* [ ] to improve log journal for each `recipe` (apache, for example) in order to shorten disk space
|
||||
|
||||
ORIGIN
|
||||
------
|
||||
|
||||
@@ -0,0 +1,652 @@
|
||||
#!/bin/bash
|
||||
|
||||
RED='\e[0;41m\e[1;37m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[0;33m'
|
||||
PURPLE='\033[0;35m'
|
||||
DARK='\e[100m'
|
||||
NC='\033[0m' # No Color
|
||||
TO_BE_DEFINED="TO BE DEFINED"
|
||||
|
||||
# BOLD='\033[1m'
|
||||
# DIM='\e[2m\e[0;90m'
|
||||
|
||||
function echo() {
|
||||
[[ -n ${PREFIX:-} ]] && printf "${DARK}%25.25s${NC} " "${PREFIX}"
|
||||
builtin echo "$@"
|
||||
}
|
||||
|
||||
function check_normal_user() {
|
||||
[[ $(id -u) -lt 1000 ]] && echoerr "normal user (>1000) expected, please connect as a normal user then call again!" && exit 100
|
||||
return 0
|
||||
}
|
||||
|
||||
function sudo_required() {
|
||||
check_normal_user
|
||||
command -v sudo &>/dev/null &&
|
||||
id -G | grep -q sudo && echoerr "command <sudo> not found, please install as so: \`apt install -y sudo\`" && exit 1
|
||||
if ! sudo -n true &>/dev/null; then
|
||||
if [[ -n "${1:-}" ]]; then
|
||||
echowarnn "[sudo] requiring authorized access for: [ $1 ]"
|
||||
else
|
||||
echowarnn "[sudo] requiring authorized access for further processing"
|
||||
fi
|
||||
fi
|
||||
sudo -vp ' : '
|
||||
}
|
||||
|
||||
# idempotent cargo install <package1 package2 ...>
|
||||
function idem_cargo_install() {
|
||||
for i in "$@"; do
|
||||
if [ ! -f ~/.cargo/bin/"$i" ]; then
|
||||
cargo install "$i"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# display error in red
|
||||
function echoerr() {
|
||||
echo -e "${RED}$*${NC}" >&2
|
||||
}
|
||||
|
||||
function echoerrn() {
|
||||
echo -en "${RED}$*${NC}" >&2
|
||||
}
|
||||
|
||||
# display warn in yellow
|
||||
function echowarn() {
|
||||
echo -e "${YELLOW}$*${NC}" >&2
|
||||
}
|
||||
|
||||
function echowarnn() {
|
||||
echo -en "${YELLOW}$*${NC}" >&2
|
||||
}
|
||||
|
||||
# display error in green
|
||||
function echoinfo() {
|
||||
echo -e "${GREEN}$*${NC}" >&2
|
||||
}
|
||||
|
||||
function echoinfon() {
|
||||
echo -en "${GREEN}$*${NC}" >&2
|
||||
}
|
||||
|
||||
# test whether <ip> is a valid ipv4 address?
|
||||
function valid_ipv4() {
|
||||
local ip="$1"
|
||||
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
||||
IFS='.' read -ra ADDR <<<"$ip"
|
||||
[[ ${ADDR[0]} -le 255 && ${ADDR[1]} -le 255 && ${ADDR[2]} -le 255 && ${ADDR[3]} -le 255 ]]
|
||||
return $?
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
function enable_trace() {
|
||||
trap 'trap_error $? ${LINENO:-0} ${BASH_LINENO:-0} ${BASH_COMMAND:-empty} $(printf "::%s" ${FUNCNAME[@]})' ERR
|
||||
}
|
||||
|
||||
function disable_trace() {
|
||||
trap - ERR
|
||||
}
|
||||
|
||||
function prepare_nftables() {
|
||||
local PREFIX="miaou:nftables"
|
||||
|
||||
if [[ ! -f /etc/nftables.rules.d/firewall.table ]]; then
|
||||
echo "installing nftables ..."
|
||||
sudo apt install -y nftables
|
||||
sudo cp -f "$MIAOU_BASEDIR/templates/hardened/nftables.conf" /etc/
|
||||
sudo mkdir -p /etc/nftables.rules.d
|
||||
sudo cp -f "$MIAOU_BASEDIR/templates/hardened/firewall.table" /etc/nftables.rules.d/
|
||||
sudo systemctl restart nftables
|
||||
sudo systemctl enable nftables
|
||||
echo "OK"
|
||||
else
|
||||
echo "nftables already installed!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
function miaou_init() {
|
||||
# shellcheck source=/dev/null
|
||||
[[ -f /opt/debian-bash/lib/functions.sh ]] && source /opt/debian-bash/lib/functions.sh
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
. "$MIAOU_BASEDIR/lib/functions.sh"
|
||||
|
||||
export MIAOU_CONFIGDIR="$HOME/.config/miaou"
|
||||
|
||||
set -Eeuo pipefail
|
||||
enable_trace
|
||||
trap 'ctrl_c $? ${LINENO:-0} ${BASH_LINENO:-0} ${BASH_COMMAND:-empty} $(printf "::%s" ${FUNCNAME[@]})' INT
|
||||
}
|
||||
|
||||
function ctrl_c() {
|
||||
PREFIX="miaou:trap" echoerr "Ctrl + C happened, exiting!!! $*"
|
||||
exit 125
|
||||
}
|
||||
|
||||
# extract source code error triggered on trap error <error_code> <error_line>
|
||||
function trap_error() {
|
||||
ERRORS_COUNT=0
|
||||
if [[ -f "$MIAOU_CONFIGDIR"/error_count ]]; then
|
||||
ERRORS_COUNT=$(cat "$MIAOU_CONFIGDIR"/error_count)
|
||||
else
|
||||
mkdir -p "$MIAOU_CONFIGDIR"
|
||||
printf 0 >"$MIAOU_CONFIGDIR"/error_count
|
||||
fi
|
||||
ERRORS_COUNT=$((ERRORS_COUNT + 1))
|
||||
printf '%s' $ERRORS_COUNT >"$MIAOU_CONFIGDIR"/error_count
|
||||
|
||||
local PREFIX=""
|
||||
|
||||
# local file="${0:-}"
|
||||
local err=$1 # error status
|
||||
local line=$2 # LINENO
|
||||
local linecallfunc=${3:-}
|
||||
local command="${4:-}"
|
||||
local funcstack="${5:-}"
|
||||
local caller
|
||||
|
||||
caller=$(caller | cut -d' ' -f2)
|
||||
|
||||
# echo >&2
|
||||
# if [ "$funcstack" != "::" ]; then
|
||||
# echo -e "${RED}ERROR <$err>, due to command <$command> at line $line from <$caller>, stack=${funcstack}${NC}" >&2
|
||||
# else
|
||||
# echo >&2 "ERROR DETECTED"
|
||||
# fi
|
||||
|
||||
# echo
|
||||
# echo -e "${PURPLE}$caller:$line ${NC}EXIT ${RED}<$err>${NC}" >&2
|
||||
# echo -e "${PURPLE}------------------------------------------ ${NC}" >&2
|
||||
if [[ $ERRORS_COUNT == 1 ]]; then
|
||||
echo
|
||||
echo -e "${RED}ERROR <$err>, due to command <$command $funcstack>${NC}" >&2
|
||||
fi
|
||||
echo -e "${PURPLE}$ERRORS_COUNT: $caller:$line ${RED}$command $funcstack${NC}" >&2
|
||||
# echo -e "${PURPLE}----------------------------- ${PURPLE}EXIT CODE ${PURPLE}--------------${PURPLE} $err ${NC}" >&2
|
||||
|
||||
# if [[ $line -gt 2 ]]; then
|
||||
# sed "$((line - 2))q;d" "$caller" >&2
|
||||
# sed "$((line - 1))q;d" "$caller" >&2
|
||||
# fi
|
||||
# echo -ne "${BOLD}" >&2
|
||||
# sed "${line}q;d" "$caller" >&2
|
||||
# echo -e "${PURPLE}------------------------------------------ ${NC}" >&2
|
||||
}
|
||||
|
||||
# exist_command(cmd1, ...)
|
||||
# test all commands exist, else fail
|
||||
function exist_command() {
|
||||
for i in "$@"; do
|
||||
command -v "$i" &>/dev/null || return 50
|
||||
done
|
||||
}
|
||||
|
||||
# test whether container <ct> is up and running?
|
||||
function container_running() {
|
||||
arg1_required "$@"
|
||||
container_exists "$1" && lxc list "$1" -c ns -f csv | head -n1 | grep -q "$1,RUNNING"
|
||||
lxc exec "$1" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
if [[ ! -f /root/cloud-status.json ]]; then
|
||||
cloud-init status --wait >/dev/null
|
||||
fi
|
||||
EOF
|
||||
}
|
||||
|
||||
# test arg1 required
|
||||
function arg1_required() {
|
||||
[[ -z "${1:-}" ]] && echoerr "ERROR: arg#1 expected!" && return 125
|
||||
return 0
|
||||
}
|
||||
|
||||
# test arg2 required
|
||||
function arg2_required() {
|
||||
[[ -z "${2:-}" ]] && echoerr "ERROR: arg#2 expected!" && return 125
|
||||
return 0
|
||||
}
|
||||
|
||||
# test whether container <ct> exists yet?
|
||||
function container_exists() {
|
||||
arg1_required "$@"
|
||||
lxc list "$1" -c n -f csv | grep -q "^$1\$"
|
||||
}
|
||||
|
||||
# build debian image with prebuild debian-bash and various useful settings
|
||||
# ARG1=release [bullseye, buster]
|
||||
function build_miaou_image() {
|
||||
local RELEASE="$1"
|
||||
local IMAGE_LABEL="$RELEASE-miaou"
|
||||
local PREFIX="miaou:image"
|
||||
|
||||
local DEB_REPOSITORY
|
||||
DEB_REPOSITORY=$(grep ^deb /etc/apt/sources.list | head -n1 | cut -d ' ' -f2 | cut -d '/' -f3)
|
||||
|
||||
if ! lxc image -cl list -f csv | grep -q "$IMAGE_LABEL"; then
|
||||
|
||||
echo "building lxc image <$IMAGE_LABEL> ... "
|
||||
echo "image will reuse same local repository <$DEB_REPOSITORY>"
|
||||
creation_date=$(date +%s)
|
||||
sudo /opt/debian-bash/tools/idem_apt_install debootstrap
|
||||
|
||||
cat <<EOF1 | sudo bash
|
||||
set -euo pipefail
|
||||
rm -rf /tmp/$IMAGE_LABEL{,-image}
|
||||
mkdir -p /tmp/$IMAGE_LABEL{,-image}
|
||||
debootstrap $RELEASE /tmp/$IMAGE_LABEL http://$DEB_REPOSITORY/debian
|
||||
|
||||
echo
|
||||
echo "DEBOOTSTRAP ... OK"
|
||||
echo
|
||||
|
||||
cat <<EOF2 | chroot /tmp/$IMAGE_LABEL
|
||||
set -euo pipefail
|
||||
echo "image prepare source.list from $DEB_REPOSITORY"
|
||||
if [[ "$RELEASE" == "buster" ]]; then
|
||||
cat <<EOF3 >/etc/apt/sources.list
|
||||
deb http://$DEB_REPOSITORY/debian $RELEASE main contrib
|
||||
deb http://$DEB_REPOSITORY/debian $RELEASE-updates main contrib
|
||||
deb http://$DEB_REPOSITORY/debian-security/ $RELEASE/updates main contrib
|
||||
EOF3
|
||||
else
|
||||
cat <<EOF3 >/etc/apt/sources.list
|
||||
deb http://$DEB_REPOSITORY/debian $RELEASE main contrib
|
||||
deb http://$DEB_REPOSITORY/debian $RELEASE-updates main contrib
|
||||
deb http://$DEB_REPOSITORY/debian-security/ $RELEASE-security main contrib
|
||||
EOF3
|
||||
fi
|
||||
|
||||
echo APT UPDATE
|
||||
|
||||
apt update && apt dist-upgrade -y
|
||||
apt install -y curl wget file git sudo bash-completion
|
||||
curl https://git.artcode.re/pvincent/debian-bash/raw/branch/master/install.sh | sudo bash -s -- --host
|
||||
ln -sf /usr/share/zoneinfo/Indian/Reunion /etc/localtime
|
||||
cat <<EOF3 >/etc/network/interfaces
|
||||
# This file describes the network interfaces available on your system
|
||||
# and how to activate them. For more information, see interfaces(5).
|
||||
|
||||
# The loopback network interface
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
auto eth0
|
||||
iface eth0 inet dhcp
|
||||
|
||||
source /etc/network/interfaces.d/*
|
||||
EOF3
|
||||
echo "deboostrap ready!"
|
||||
EOF2
|
||||
cd /tmp/$IMAGE_LABEL-image
|
||||
tar -czf rootfs.tar.gz -C /tmp/$IMAGE_LABEL .
|
||||
cat <<EOF2 >metadata.yaml
|
||||
architecture: "x86_64"
|
||||
creation_date: $creation_date
|
||||
properties:
|
||||
architecture: "x86_64"
|
||||
description: "Debian $RELEASE for miaou instances"
|
||||
os: "debian"
|
||||
release: "$RELEASE"
|
||||
EOF2
|
||||
tar -czf metadata.tar.gz metadata.yaml
|
||||
EOF1
|
||||
lxc image import "/tmp/$IMAGE_LABEL-image/metadata.tar.gz" "/tmp/$IMAGE_LABEL-image/rootfs.tar.gz" --alias "$IMAGE_LABEL"
|
||||
echo "image <$IMAGE_LABEL> successfully built!"
|
||||
echo DONE
|
||||
else
|
||||
echo "image <$IMAGE_LABEL> already built!"
|
||||
fi
|
||||
}
|
||||
|
||||
# execute remote scripting onto one LXC container <CONTAINER> [COMMANDS, ...]
|
||||
# may use one command like: `lxc_exec ct1 uname -a`
|
||||
# or pipe like so: `
|
||||
# cat <<EOF | lxc_exec ct1
|
||||
# ls -l
|
||||
# uname -a
|
||||
# echo [\$0] [\$1] [\$2] # toto titi tata
|
||||
# EOF
|
||||
# `
|
||||
function lxc_exec() {
|
||||
arg1_required "$@"
|
||||
container="$1"
|
||||
shift
|
||||
|
||||
declare -a ARGUMENTS
|
||||
ARGUMENTS=(toto titi tata) # might be overriden with interesting stuff!
|
||||
|
||||
if ((${#} == 0)); then
|
||||
multiline=""
|
||||
while read -r line; do
|
||||
if [[ ! "$line" =~ ^\# ]] && [[ ! "$line" =~ ^[[:space:]]*$ ]]; then
|
||||
if [[ "$line" =~ .*\;$ ]] || [[ "$line" =~ do$ ]] || [[ "$line" =~ then$ ]] || [[ "$line" =~ else$ ]]; then
|
||||
multiline+="${line} " # append space in case of ending with either '; do then else'
|
||||
else
|
||||
multiline+="${line};" # append ; for multiple commands
|
||||
fi
|
||||
fi
|
||||
done
|
||||
# echo "DEBUG: multiline = [$multiline]"
|
||||
# echo DEBUG: lxc exec "$container" -- bash -lc "$multiline" "${ARGUMENTS[@]}"
|
||||
lxc exec "$container" -- bash -lc "$multiline" "${ARGUMENTS[@]}"
|
||||
else
|
||||
lxc exec "$container" -- bash -lc "$*" "${ARGUMENTS[@]}"
|
||||
fi
|
||||
}
|
||||
|
||||
# check container exist and running
|
||||
function check_container() {
|
||||
arg1_required "$@"
|
||||
local CT="$1"
|
||||
container_exists "$CT"
|
||||
container_running "$CT"
|
||||
}
|
||||
|
||||
function launch_container() {
|
||||
arg1_required "$@"
|
||||
local ct="$1"
|
||||
if ! container_exists "$ct"; then
|
||||
echo "container <$ct> about to be created ..."
|
||||
local extra_release="${2:-}"
|
||||
if [[ -n "$extra_release" ]] && ! lxc image info "${extra_release}-miaou" >/dev/null; then
|
||||
echoerrn "unknown extra_release <${extra_release}-miaou>!\nHINT : please add it into /etc/miaou/defaults.yaml, then re-install miaou!"
|
||||
exit 128
|
||||
fi
|
||||
|
||||
if [[ -n "$extra_release" ]]; then
|
||||
echoerrn "FIXME: lxc-miaou-create -o release=bookworm should be implemented ...."
|
||||
lxc-miaou-create "$ct" "$extra_release"
|
||||
else
|
||||
lxc-miaou-create "$ct"
|
||||
fi
|
||||
echo "DONE"
|
||||
fi
|
||||
|
||||
if ! container_running "$ct"; then
|
||||
echowarn "container <$ct> seems to be asleep, starting ..."
|
||||
lxc start "$ct"
|
||||
echowarn DONE
|
||||
fi
|
||||
}
|
||||
|
||||
function load_yaml_from_expanded {
|
||||
arg1_required "$@"
|
||||
yaml_key="$1"
|
||||
yaml_file="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
yaml_value=$(yq ".$yaml_key" "$yaml_file")
|
||||
if [[ -n "$yaml_value" ]] && [[ "$yaml_value" != "null" ]] && [[ "$yaml_value" != "$TO_BE_DEFINED" ]]; then
|
||||
PREFIX="" echo "$yaml_value"
|
||||
else
|
||||
echoerr "undefined value for key: <$yaml_key> from file: <$yaml_file>"
|
||||
return 98
|
||||
fi
|
||||
}
|
||||
|
||||
function check_yaml_defined_value {
|
||||
yaml_file="$1"
|
||||
yaml_key="$2"
|
||||
yaml_value=$(yq ".$yaml_key" "$yaml_file")
|
||||
if [[ -n "$yaml_value" ]] && [[ "$yaml_value" != "null" ]] && [[ "$yaml_value" != "$TO_BE_DEFINED" ]]; then
|
||||
return 0
|
||||
else
|
||||
echoerr "undefined value for key: <$yaml_key> from file: <$yaml_file>"
|
||||
return 99
|
||||
fi
|
||||
}
|
||||
|
||||
# halt unless current user is root
|
||||
function root_required() {
|
||||
[[ $(id -u) == 0 ]] || (echoerr "root required" && return 1)
|
||||
}
|
||||
|
||||
# arg#1: environment variable
|
||||
# read from environment or ask entry before exporting new variable
|
||||
function env_or_ask {
|
||||
if [[ -n ${1+x} ]]; then
|
||||
if printenv "$1" >/dev/null; then
|
||||
echo "value defined as $(printenv "$1")"
|
||||
else
|
||||
printf "Please define %20s: " "$1"
|
||||
read -r
|
||||
export "$1=\"$REPLY\"" >/dev/null
|
||||
fi
|
||||
else
|
||||
echoerr "env_or_ask requires one argument: <VARIABLE_NAME>" && exit 5
|
||||
fi
|
||||
}
|
||||
|
||||
# install_debian_bash()
|
||||
# grab and install related project
|
||||
function install_debian_bash() {
|
||||
local PREFIX="debian-bash:install"
|
||||
if [[ ! -d /opt/debian-bash ]]; then
|
||||
echo "installing curl wget commands ..."
|
||||
apt install -y curl wget
|
||||
|
||||
echo "installing debian-bash..."
|
||||
curl https://git.artcode.re/pvincent/debian-bash/raw/branch/master/install.sh | sudo bash -s -- --host
|
||||
export PATH=$PATH:/opt/debian-bash/tools/
|
||||
echo "OK"
|
||||
else
|
||||
# /opt/debian-bash/tools/debian_bash_upgrade
|
||||
echo "addon <debian-bash> already installed!"
|
||||
fi
|
||||
# shellcheck source=/dev/null
|
||||
source /etc/bash.bashrc
|
||||
|
||||
sudo /opt/debian-bash/tools/idem_apt_install bash-completion
|
||||
}
|
||||
|
||||
function add_toolbox_sudoers {
|
||||
local PREFIX="toolbox:sudoers"
|
||||
echo -n "creating sudoers file to allow sudo as command from /TOOLBOX... "
|
||||
sudo mkdir -p /etc/sudoers.d
|
||||
if [[ ! -f /etc/sudoers.d/add_TOOLBOX_to_PATH ]]; then
|
||||
sudo tee /etc/sudoers.d/add_TOOLBOX_to_PATH &>/dev/null <<EOF
|
||||
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/TOOLBOX"
|
||||
EOF
|
||||
PREFIX="" echo "updated!"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
}
|
||||
|
||||
function prepare_toolbox() {
|
||||
local PREFIX="toolbox:prepare"
|
||||
sudo mkdir -p /TOOLBOX
|
||||
|
||||
if ! command -v cargo &>/dev/null; then
|
||||
echo -n "installing <cargo> ... "
|
||||
curl -sSf https://sh.rustup.rs | sh -s -- -y
|
||||
# shellcheck source=/dev/null
|
||||
source "$HOME/.cargo/env"
|
||||
/opt/debian-bash/tools/append_or_replace "^PATH=\$PATH:\$HOME/\\.cargo/bin" "PATH=\$PATH:\$HOME/.cargo/bin" ~/.bashrc
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "command <cargo> already installed!"
|
||||
fi
|
||||
|
||||
echo -n "installing <fd> ... "
|
||||
if [ ! -f "/TOOLBOX/fd" ]; then
|
||||
idem_cargo_install fd-find
|
||||
sudo cp "$HOME"/.cargo/bin/fd /TOOLBOX/fd
|
||||
PREFIX="" echo "successfully installed!"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <viu> ... "
|
||||
if [ ! -f "/TOOLBOX/viu" ]; then
|
||||
idem_cargo_install viu
|
||||
sudo cp "$HOME"/.cargo/bin/viu /TOOLBOX/
|
||||
PREFIX="" echo "successfully installed!"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <rg> alias <ripgrep> ... "
|
||||
if [ ! -f "/TOOLBOX/rg" ]; then
|
||||
|
||||
sudo /opt/debian-bash/tools/idem_apt_install ripgrep
|
||||
sudo ln /usr/bin/rg /TOOLBOX/
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <ag> alias <silversearcher-ag> ... "
|
||||
if [ ! -f "/TOOLBOX/ag" ]; then
|
||||
sudo /opt/debian-bash/tools/idem_apt_install silversearcher-ag
|
||||
sudo ln /usr/bin/ag /TOOLBOX/
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <bandwhich> ... "
|
||||
if [ ! -f "/TOOLBOX/bandwhich" ]; then
|
||||
idem_cargo_install bandwhich
|
||||
sudo cp "$HOME"/.cargo/bin/bandwhich /TOOLBOX/bandwhich
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <btm> alias <bottom> ... "
|
||||
if [ ! -f "/TOOLBOX/btm" ]; then
|
||||
VERSION=$(wget_semver github ClementTsang/bottom)
|
||||
cd /tmp
|
||||
wget "https://github.com/ClementTsang/bottom/releases/download/$VERSION/bottom_x86_64-unknown-linux-musl.tar.gz"
|
||||
tar -xzvf bottom_x86_64-unknown-linux-musl.tar.gz
|
||||
sudo cp btm /usr/local/bin/
|
||||
sudo ln /usr/local/bin/btm /TOOLBOX/
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <micro> ... "
|
||||
if [ ! -f "/TOOLBOX/micro" ]; then
|
||||
cd /tmp || (echoerr "/tmp wrong permission" && exit 101)
|
||||
curl -q https://getmic.ro | GETMICRO_REGISTER=n sh
|
||||
sudo mv micro /TOOLBOX/micro
|
||||
sudo chown root:root /TOOLBOX/micro
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <ncdu> ... "
|
||||
if [ ! -f "/TOOLBOX/ncdu" ]; then
|
||||
sudo /opt/debian-bash/tools/idem_apt_install ncdu
|
||||
sudo cp /usr/bin/ncdu /TOOLBOX/ncdu
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <unzip> ... "
|
||||
if [ ! -f "/TOOLBOX/unzip" ]; then
|
||||
sudo /opt/debian-bash/tools/idem_apt_install unzip
|
||||
sudo cp /usr/bin/unzip /TOOLBOX/unzip
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <tree> ... "
|
||||
if [ ! -f "/TOOLBOX/tree" ]; then
|
||||
sudo /opt/debian-bash/tools/idem_apt_install tree
|
||||
sudo cp /bin/tree /TOOLBOX/tree
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <duf> ... "
|
||||
if [ ! -f "/TOOLBOX/duf" ]; then
|
||||
VERSION=$(/opt/debian-bash/tools/wget_semver github muesli/duf)
|
||||
VERSION_WITHOUT_V=${VERSION#v}
|
||||
wget -O /tmp/duf.deb "https://github.com/muesli/duf/releases/download/${VERSION}/duf_${VERSION_WITHOUT_V}_linux_amd64.deb"
|
||||
sudo dpkg -i /tmp/duf.deb
|
||||
sudo cp /bin/duf /TOOLBOX/duf
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <curl> ... "
|
||||
if [ ! -f "/TOOLBOX/curl" ]; then
|
||||
sudo wget -O /TOOLBOX/curl "https://github.com/moparisthebest/static-curl/releases/latest/download/curl-amd64"
|
||||
sudo chmod +x /TOOLBOX/curl
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
echo -n "installing <wget> ... "
|
||||
if [ ! -f "/TOOLBOX/wget" ]; then
|
||||
sudo ln -f /usr/bin/wget /TOOLBOX/wget
|
||||
PREFIX="" echo "successfully installed"
|
||||
else
|
||||
PREFIX="" echo "already done!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# install_mandatory_commands
|
||||
function install_mandatory_commands() {
|
||||
local PREFIX="mandatory:commands"
|
||||
|
||||
sudo /opt/debian-bash/tools/idem_apt_install dnsutils build-essential curl mariadb-client postgresql-client
|
||||
|
||||
if ! exist_command tera; then
|
||||
echo "installing <tera> ..."
|
||||
|
||||
local version=v0.2.4
|
||||
wget -q "https://github.com/chevdor/tera-cli/releases/download/${version}/tera-cli_linux_amd64.deb" -O /tmp/tera-cli_linux_amd64.deb
|
||||
sudo dpkg -i /tmp/tera-cli_linux_amd64.deb
|
||||
else
|
||||
echo "command <tera> already installed!"
|
||||
fi
|
||||
|
||||
if ! exist_command yq; then
|
||||
local version binary
|
||||
version='v4.35.2'
|
||||
binary='yq_linux_amd64'
|
||||
|
||||
sudo sh -c "wget https://github.com/mikefarah/yq/releases/download/${version}/${binary}.tar.gz -O - |\
|
||||
tar -xz ./${binary} && sudo mv ${binary} /usr/bin/yq"
|
||||
else
|
||||
echo "command <yq> already installed!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# flatten array, aka remove duplicated elements in array
|
||||
# return: `mapfile -t OUTPUT_ARRAY < <(sort_array "${INPUT_ARRAY[@]}")`
|
||||
function flatten_array {
|
||||
declare -a array=("$@")
|
||||
IFS=" " read -r -a array <<<"$(tr ' ' '\n' <<<"${array[@]}" | sort -u | tr '\n' ' ')"
|
||||
printf '%s\n' "${array[@]}"
|
||||
}
|
||||
|
||||
function prepare_nftables() {
|
||||
local PREFIX="miaou:firewall"
|
||||
|
||||
if [[ ! -f /etc/nftables.rules.d/firewall.table ]]; then
|
||||
echo "installing nftables ..."
|
||||
sudo apt install -y nftables
|
||||
sudo cp -f "$MIAOU_BASEDIR/templates/hardened/nftables.conf" /etc/
|
||||
sudo mkdir -p /etc/nftables.rules.d
|
||||
sudo cp -f "$MIAOU_BASEDIR/templates/hardened/firewall.table" /etc/nftables.rules.d/
|
||||
sudo systemctl restart nftables
|
||||
sudo systemctl enable nftables
|
||||
echo "OK"
|
||||
else
|
||||
echo "nftables already installed!"
|
||||
fi
|
||||
}
|
||||
Executable
+294
@@ -0,0 +1,294 @@
|
||||
#!/bin/bash
|
||||
|
||||
### FUNCTIONS
|
||||
### ---------
|
||||
|
||||
function prepare_config_hardened() {
|
||||
mkdir -p "$HARDEN_CONFIGDIR"
|
||||
}
|
||||
|
||||
function pubkey_authorize() {
|
||||
local PREFIX="harden:pubkey:authorize"
|
||||
|
||||
if [[ ! -d $HOME/.ssh ]]; then
|
||||
echo -n "create .ssh folder for the first time ..."
|
||||
mkdir -m 700 ~/.ssh
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
local security_issue_in_ssh_folder
|
||||
security_issue_in_ssh_folder=$(find "$HOME/.ssh" -perm -go=r | wc -l)
|
||||
if [[ $security_issue_in_ssh_folder -gt 0 ]]; then
|
||||
echo -n "force security in .ssh folder for <$CURRENT_USER> ..."
|
||||
chmod -R u+rwX,go-rwx "/home/$CURRENT_USER/.ssh"
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "security in .ssh folder for <$CURRENT_USER> approved!"
|
||||
fi
|
||||
fi
|
||||
|
||||
pubkey_value=$(yq ".authorized.pubkey" "$HARDEN_CONFIGFILE")
|
||||
if [[ ! -f /home/$CURRENT_USER/.ssh/authorized_keys ]]; then
|
||||
echo -n "authorized_keys first time ..."
|
||||
PREFIX="" echo "$pubkey_value" >"$HOME/.ssh/authorized_keys"
|
||||
chmod u+rw,go-rwx "/home/$CURRENT_USER/.ssh/authorized_keys"
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
if ! grep -q "^$pubkey_value" "/home/$CURRENT_USER/.ssh/authorized_keys"; then
|
||||
echo -n "pubkey <$CURRENT_USER> appended to <.ssh/authorized_keys> ..."
|
||||
echo "$pubkey_value" >>"$HOME/.ssh/authorized_keys"
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "pubkey <$CURRENT_USER> already authorized!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
function sudoers() {
|
||||
local PREFIX="harden:sudoers"
|
||||
if [[ -d /etc/sudoers.d ]]; then
|
||||
echo -n "add $CURRENT_USER and no more ..."
|
||||
|
||||
sudo env current_user="$CURRENT_USER" tera -e --env-key env --env-only -o /etc/sudoers -t "$MIAOU_BASEDIR/templates/hardened/sudoers.j2" >/dev/null
|
||||
|
||||
rm /etc/sudoers.d -rf
|
||||
grep -Eq "^debian" /etc/passwd && userdel -rf debian
|
||||
grep -Eq "^sudo" /etc/group && groupdel sudo
|
||||
passwd -dq root
|
||||
passwd -dq "$CURRENT_USER"
|
||||
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "sudo authorized for <$CURRENT_USER> only!"
|
||||
fi
|
||||
}
|
||||
|
||||
function sshd() {
|
||||
local PREFIX="harden:sshd"
|
||||
if [[ ! -f /etc/ssh/sshd_config ]]; then
|
||||
sudo apt install -y openssh-server
|
||||
else
|
||||
echo "sshd already installed!"
|
||||
fi
|
||||
|
||||
if ! grep -Eq "^Port 2222" /etc/ssh/sshd_config; then
|
||||
echo -n "replacing sshd ..."
|
||||
|
||||
sudo env current_user="$CURRENT_USER" tera -e --env-key env --env-only -o /etc/ssh/sshd_config -t "$MIAOU_BASEDIR/templates/hardened/sshd_config.j2" >/dev/null
|
||||
sudo systemctl restart sshd
|
||||
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "already done!"
|
||||
fi
|
||||
}
|
||||
|
||||
function prepare_proxy() {
|
||||
local PREFIX="harden:proxy"
|
||||
|
||||
if ! grep -Eq "^precedence ::ffff:0:0/96.*" /etc/gai.conf; then
|
||||
echo "prefer ipv4 ..."
|
||||
sudo /opt/debian-bash/tools/append_or_replace "^precedence ::ffff:0:0/96.*" "precedence ::ffff:0:0/96 100" /etc/gai.conf
|
||||
echo "OK"
|
||||
else
|
||||
echo "ipv4 already prefered!"
|
||||
fi
|
||||
|
||||
if ! grep -Eq "^net.ipv4.ip_forward=1" /etc/sysctl.conf; then
|
||||
echo "allow forwarding from kernel ..."
|
||||
sudo /opt/debian-bash/tools/append_or_replace "^net.ipv4.ip_forward=1.*" "net.ipv4.ip_forward=1" /etc/sysctl.conf
|
||||
sudo sysctl -p
|
||||
echo "OK"
|
||||
else
|
||||
echo "kernel forwarding already allowed!"
|
||||
fi
|
||||
}
|
||||
|
||||
function set_current_user {
|
||||
local PREFIX="harden:environment"
|
||||
|
||||
CURRENT_USER=$(id -un)
|
||||
echo "current user is <$CURRENT_USER>"
|
||||
}
|
||||
|
||||
function load_configuration {
|
||||
local PREFIX="harden:configuration:load"
|
||||
|
||||
if [[ ! -f "$HARDEN_CONFIGFILE" ]]; then
|
||||
echo "configuration requires further details ..."
|
||||
cp "$MIAOU_BASEDIR/templates/hardened/hardened.yaml.sample" "$HARDEN_CONFIGFILE"
|
||||
echo "OK"
|
||||
fi
|
||||
|
||||
editor "$HARDEN_CONFIGFILE"
|
||||
}
|
||||
|
||||
function check_configuration {
|
||||
local PREFIX="harden:configuration:check"
|
||||
|
||||
check_yaml_defined_value "$HARDEN_CONFIGFILE" 'authorized.pubkey'
|
||||
check_yaml_defined_value "$HARDEN_CONFIGFILE" 'alert.to'
|
||||
check_yaml_defined_value "$HARDEN_CONFIGFILE" 'alert.from'
|
||||
check_yaml_defined_value "$HARDEN_CONFIGFILE" 'alert.smtp.server'
|
||||
}
|
||||
|
||||
function set_timezone_if_defined {
|
||||
local PREFIX="harden:timezone"
|
||||
timezone=$(yq ".timezone" "$HARDEN_CONFIGFILE")
|
||||
if [[ "$timezone" != null ]]; then
|
||||
if ! grep -q "$timezone" /etc/timezone; then
|
||||
if [[ -f "/usr/share/zoneinfo/$timezone" ]]; then
|
||||
echo "set timezone to $timezone ..."
|
||||
ln -fs "/usr/share/zoneinfo/$timezone" /etc/localtime
|
||||
dpkg-reconfigure -f noninteractive tzdata
|
||||
echo OK
|
||||
else
|
||||
echoerr "unkown timezone: <$timezone>, please edit <$HARDEN_CONFIGFILE> and change to a correct value" && exit 98
|
||||
fi
|
||||
else
|
||||
echo "timezone <$timezone> already set!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
function mailer_alert() {
|
||||
local PREFIX="harden:mailer"
|
||||
|
||||
if [[ ! -f /etc/msmtprc ]]; then
|
||||
for i in exim4-config libevent-2.1-7 libgnutls-dane0 libunbound8; do
|
||||
if dpkg -l "$i" 2>/dev/null | grep -q ^ii && echo 'installed'; then
|
||||
echo "purging package <$i> ..."
|
||||
apt purge -y "$i"
|
||||
echo "OK"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "installing <msmtp> ..."
|
||||
sudo /opt/debian-bash/tools/idem_apt_install msmtp msmtp-mta mailutils bsd-mailx
|
||||
echo "OK"
|
||||
|
||||
echo "configuring </etc/aliases>"
|
||||
sudo env current_user="$CURRENT_USER" tera -e --env-key env -o /etc/aliases -t "$MIAOU_BASEDIR/templates/hardened/mailer/aliases.j2" "$HARDEN_CONFIGDIR/hardened.yaml" >/dev/null
|
||||
echo "OK"
|
||||
|
||||
# populate environment variable with fqdn
|
||||
fqdn=$(hostname -f)
|
||||
|
||||
echo "configuring </etc/mail.rc>"
|
||||
sudo env current_user="$CURRENT_USER" fqdn="$fqdn" tera -e --env-key env -o /etc/mail.rc -t "$MIAOU_BASEDIR/templates/hardened/mailer/mail.rc.j2" "$HARDEN_CONFIGDIR/hardened.yaml" >/dev/null
|
||||
echo "OK"
|
||||
|
||||
echo "generating </etc/msmtprc> configuration file ..."
|
||||
sudo env fqdn="$fqdn" tera -e --env-key env -o /etc/msmtprc -t "$MIAOU_BASEDIR/templates/hardened/mailer/msmtprc.j2" "$HARDEN_CONFIGDIR/hardened.yaml" >/dev/null
|
||||
sudo chown root:msmtp /etc/msmtprc
|
||||
sudo chmod 640 /etc/msmtprc
|
||||
echo "OK"
|
||||
else
|
||||
echo "mailer <msmtp> already configured!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
function alert_at_boot() {
|
||||
local PREFIX="harden:alert:boot"
|
||||
if ! systemctl is-enabled --quiet on_startup.service 2>/dev/null; then
|
||||
echo "installing <on_startup.service> on systemd..."
|
||||
sudo cp "$MIAOU_BASEDIR/templates/hardened/systemd/on_startup.service" /etc/systemd/system/on_startup.service
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable on_startup.service
|
||||
REBOOT=true
|
||||
echo "OK"
|
||||
else
|
||||
echo "systemd <on_startup.service> already enabled!"
|
||||
fi
|
||||
}
|
||||
|
||||
function show_reboot_on_purpose() {
|
||||
if "$REBOOT"; then
|
||||
PREFIX="harden:reboot" echowarn "we recommend reboot on purpose, Reboot NOW?"
|
||||
else
|
||||
PREFIX="harden" echo "success"
|
||||
fi
|
||||
}
|
||||
|
||||
function disable_systemd_resolved() {
|
||||
PREFIX="harden:systemd:resolved"
|
||||
if file /etc/resolv.conf | grep -q /run/systemd/resolve/stub-resolv.conf; then
|
||||
echo "disabling systemd-resolved..."
|
||||
sudo systemctl stop systemd-resolved.service
|
||||
sudo systemctl disable systemd-resolved.service
|
||||
sudo rm /etc/resolv.conf
|
||||
cat <<EOF | sudo tee /etc/resolv.conf
|
||||
nameserver 1.1.1.1
|
||||
EOF
|
||||
echo "OK"
|
||||
else
|
||||
echo "systemd-resolved already disabled!"
|
||||
fi
|
||||
}
|
||||
|
||||
function alert_at_ssh_password() {
|
||||
local PREFIX="harden:alert:ssh:password"
|
||||
if ! grep -Eq "^session optional pam_exec.so /usr/local/bin/alert_ssh_password.sh" /etc/pam.d/sshd; then
|
||||
echo "installing alert_at_ssh_password..."
|
||||
sudo cp "$MIAOU_BASEDIR/templates/hardened/pam/alert_ssh_password.sh" /usr/local/bin/
|
||||
sudo chmod 700 /usr/local/bin/alert_ssh_password.sh
|
||||
sudo /opt/debian-bash/tools/append_or_replace "^session optional pam_exec.so /usr/local/bin/alert_ssh_password.sh" "session optional pam_exec.so /usr/local/bin/alert_ssh_password.sh" /etc/pam.d/sshd
|
||||
echo "OK"
|
||||
else
|
||||
echo "alert_at_ssh_password already enabled!"
|
||||
fi
|
||||
}
|
||||
|
||||
function customize_motd {
|
||||
local PREFIX="harden:motd:customize"
|
||||
if [[ ! -f /etc/update-motd.d/80-users ]]; then
|
||||
echo "customizing motd..."
|
||||
sudo /opt/debian-bash/tools/idem_apt_install figlet lsb-release
|
||||
sudo rm -f /etc/motd
|
||||
sudo mkdir -p /etc/update-motd.d
|
||||
sudo rm -f /etc/update-motd.d/*
|
||||
sudo cp "$MIAOU_BASEDIR"/templates/hardened/motd/* /etc/update-motd.d/
|
||||
sudo chmod +x /etc/update-motd.d/*
|
||||
echo "OK"
|
||||
else
|
||||
echo "motd already customized!"
|
||||
fi
|
||||
}
|
||||
|
||||
### CONSTANTS
|
||||
### ---------
|
||||
|
||||
MIAOU_BASEDIR=$(readlink -f "$(dirname "$0")/..")
|
||||
readonly HARDEN_CONFIGDIR="$HOME/.config/hardened"
|
||||
readonly HARDEN_CONFIGFILE="$HARDEN_CONFIGDIR/hardened.yaml"
|
||||
|
||||
### MAIN
|
||||
### ----
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
. "$MIAOU_BASEDIR/lib/functions.sh"
|
||||
miaou_init
|
||||
|
||||
REBOOT=false
|
||||
PREFIX="harden"
|
||||
: $PREFIX
|
||||
|
||||
sudo_required
|
||||
install_debian_bash
|
||||
install_mandatory_commands
|
||||
prepare_config_hardened
|
||||
set_current_user
|
||||
check_configuration 2>/dev/null || load_configuration
|
||||
check_configuration
|
||||
pubkey_authorize
|
||||
sshd
|
||||
prepare_proxy
|
||||
prepare_nftables
|
||||
disable_systemd_resolved
|
||||
set_timezone_if_defined
|
||||
mailer_alert
|
||||
alert_at_boot
|
||||
alert_at_ssh_password
|
||||
customize_motd
|
||||
|
||||
show_reboot_on_purpose
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/bin/bash
|
||||
|
||||
MIAOU_DIR="$(dirname "$0")/../.."
|
||||
readonly MIAOU_DIR
|
||||
|
||||
function init_strict() {
|
||||
set -Eeuo pipefail
|
||||
# shellcheck source=/dev/null
|
||||
source "$MIAOU_DIR/lib/functions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "/opt/debian-bash/lib/functions.sh"
|
||||
trap 'trap_error $? $LINENO $BASH_LINENO "$BASH_COMMAND" $(printf "::%s" ${FUNCNAME[@]})' ERR
|
||||
}
|
||||
|
||||
## main
|
||||
init_strict
|
||||
sudo_required
|
||||
build_miaou_image "bullseye"
|
||||
Executable
+19
@@ -0,0 +1,19 @@
|
||||
#!/bin/bash
|
||||
|
||||
MIAOU_DIR="$(dirname "$0")/../.."
|
||||
readonly MIAOU_DIR
|
||||
|
||||
function init_strict() {
|
||||
set -Eeuo pipefail
|
||||
# shellcheck source=/dev/null
|
||||
source "$MIAOU_DIR/lib/functions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "/opt/debian-bash/lib/functions.sh"
|
||||
|
||||
trap 'trap_error $? $LINENO $BASH_LINENO "$BASH_COMMAND" $(printf "::%s" ${FUNCNAME[@]})' ERR
|
||||
}
|
||||
|
||||
## main
|
||||
init_strict
|
||||
sudo_required
|
||||
build_miaou_image "buster"
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
. "$MIAOU_BASEDIR/lib/functions.sh"
|
||||
miaou_init
|
||||
Executable
+409
@@ -0,0 +1,409 @@
|
||||
#!/bin/bash
|
||||
|
||||
MIAOU_BASEDIR=$(readlink -f "$(dirname "$0")/..")
|
||||
# shellcheck source=/dev/null
|
||||
. "$MIAOU_BASEDIR/lib/functions.sh"
|
||||
readonly MIAOU_BASEDIR
|
||||
|
||||
miaou_init
|
||||
|
||||
EXPANDED_CONF="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
NEW_GROUP=lxd
|
||||
readonly NEW_GROUP EXPANDED_CONF
|
||||
|
||||
on_exit() {
|
||||
if [[ "$SESSION_RELOAD_REQUIRED" == true ]]; then
|
||||
echo "======================================================"
|
||||
echo "Session Reload is required (due to new group <$NEW_GROUP>)"
|
||||
echo "======================================================"
|
||||
fi
|
||||
if [ -n "${1:-}" ]; then
|
||||
echo "Aborted by $1"
|
||||
elif [ "${status:-}" -ne 0 ]; then
|
||||
echo "Failure (status $status)"
|
||||
fi
|
||||
}
|
||||
|
||||
function prepare_lxd {
|
||||
local PREFIX="lxd:prepare"
|
||||
|
||||
# test group lxd assign to current user
|
||||
if ! groups | grep -q lxd; then
|
||||
echo "define lxd and assign to user <$USER>"
|
||||
sudo groupadd --force "$NEW_GROUP"
|
||||
sudo usermod --append --groups "$NEW_GROUP" "$(whoami)"
|
||||
exec sg "$NEW_GROUP" "exec '$0' $(printf "'%s' " SESSION_RELOAD_REQUIRED "$@")"
|
||||
# no further processing because exec has been called!
|
||||
else
|
||||
echo "user <$USER> already belongs to group <lxd>!"
|
||||
fi
|
||||
|
||||
sudo /opt/debian-bash/tools/idem_apt_install lxd btrfs-progs
|
||||
|
||||
# test lxdbr0
|
||||
if ! lxc network info lxdbr0 &>/dev/null; then
|
||||
echo "bridge <lxdbr0> down, so initialization will use default preseed..."
|
||||
sudo lxd init
|
||||
# cat <<EOF | sudo lxd init --preseed
|
||||
|
||||
# NEW
|
||||
# networks:
|
||||
# - config:
|
||||
# ipv4.address: auto
|
||||
# ipv6.address: none
|
||||
# description: ""
|
||||
# name: lxdbr0
|
||||
# type: ""
|
||||
# project: default
|
||||
# storage_pools:
|
||||
# - config:
|
||||
# source: /dev/sda4
|
||||
# description: ""
|
||||
# name: default
|
||||
# driver: btrfs
|
||||
# profiles:
|
||||
# - config: {}
|
||||
# description: ""
|
||||
# devices:
|
||||
# eth0:
|
||||
# name: eth0
|
||||
# network: lxdbr0
|
||||
# type: nic
|
||||
# root:
|
||||
# path: /
|
||||
# pool: default
|
||||
# type: disk
|
||||
# name: default
|
||||
# projects: []
|
||||
# cluster: null
|
||||
|
||||
# OLD
|
||||
# networks:
|
||||
# - config:
|
||||
# ipv4.address: auto
|
||||
# ipv6.address: none
|
||||
# description: ""
|
||||
# name: lxdbr0
|
||||
# type: ""
|
||||
# project: default
|
||||
# storage_pools:
|
||||
# - config:
|
||||
# source: /dev/sda4
|
||||
# description: ""
|
||||
# name: default
|
||||
# driver: btrfs
|
||||
# profiles:
|
||||
# - config: {}
|
||||
# description: ""
|
||||
# devices:
|
||||
# eth0:
|
||||
# name: eth0
|
||||
# network: lxdbr0
|
||||
# type: nic
|
||||
# root:
|
||||
# path: /
|
||||
# pool: default
|
||||
# type: disk
|
||||
# name: default
|
||||
# projects: []
|
||||
# cluster: null
|
||||
|
||||
echo OK
|
||||
else
|
||||
echo "bridge <lxdbr0> found implies it has been already initialized!"
|
||||
fi
|
||||
|
||||
set_alias 'sameuser' "exec @ARG1@ -- su --whitelist-environment container_hostname - $(whoami)"
|
||||
set_alias 'login' 'exec @ARGS@ --mode interactive -- /bin/bash -c $@${user:-root} - exec su --whitelist-environment container_hostname - '
|
||||
set_alias 'll' 'list -c ns4mDN'
|
||||
|
||||
# test environment container hostname
|
||||
local env_container_hostname=$(lxc profile get default environment.container_hostname)
|
||||
if [[ -z "$env_container_hostname" ]]; then
|
||||
env_container_hostname=$(hostname -s)
|
||||
if env | grep -q container_hostname; then
|
||||
local previous_container_hostname=$(env | grep container_hostname | cut -d '=' -f2)
|
||||
env_container_hostname="$previous_container_hostname $env_container_hostname"
|
||||
fi
|
||||
|
||||
echo -n "set environment container_hostname to <$env_container_hostname> ... "
|
||||
lxc profile set default environment.container_hostname "$env_container_hostname"
|
||||
PREFIX="" echoinfo OK
|
||||
else
|
||||
echo "environment container_hostname <$env_container_hostname> already defined!"
|
||||
fi
|
||||
|
||||
if ! grep -q "root:$(id -u):1" /etc/subuid; then
|
||||
echo -n "subuid, subgid allowing <$(whoami)> ..."
|
||||
printf "root:$(id -u):1\n" | sudo tee -a /etc/subuid /etc/subgid
|
||||
PREFIX="" echoinfo DONE
|
||||
|
||||
# root:1000:1
|
||||
# root:100000:65536
|
||||
# _lxd:100000:65536
|
||||
# <USER>:100000:65536
|
||||
|
||||
else
|
||||
echo "subuid, subgid allowing <$(whoami)> already done!"
|
||||
fi
|
||||
|
||||
if [[ ! -d "$HOME/LXD/SHARED" ]]; then
|
||||
echo -n "$HOME/LXD/SHARED creating ... "
|
||||
mkdir "$HOME/LXD/SHARED" -p
|
||||
PREFIX="" echoinfo DONE
|
||||
else
|
||||
echo "folder <$HOME/LXD/SHARED> already created!"
|
||||
fi
|
||||
|
||||
if [[ ! -d "$HOME/LXD/BACKUP" ]]; then
|
||||
echo -n "$HOME/LXD/SHARED creating ... "
|
||||
mkdir "$HOME/LXD/SHARED" -p
|
||||
PREFIX="" echoinfo DONE
|
||||
else
|
||||
echo "folder <$HOME/LXD/BACKUP> already created!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
function set_alias {
|
||||
local name="$1"
|
||||
local command="$2"
|
||||
if ! lxc alias list -f csv | grep -q "^$name,"; then
|
||||
echo -n "define lxc alias $name ..."
|
||||
lxc alias add "$name" "$command"
|
||||
PREFIX="" echoinfo OK
|
||||
else
|
||||
echo "lxc alias "$name" already defined!"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
function miaou_evalfrombashrc() {
|
||||
local PREFIX="miaou:bashrc"
|
||||
output=$(
|
||||
/opt/debian-bash/tools/append_or_replace \
|
||||
"^eval \"\\$\($MIAOU_BASEDIR/lib/install.sh shellenv\)\"$" \
|
||||
"eval \"\$($MIAOU_BASEDIR/lib/install.sh shellenv)\"" \
|
||||
"$HOME/.bashrc"
|
||||
)
|
||||
|
||||
if [[ "$output" == "appended" ]]; then
|
||||
echo "new path <$MIAOU_BASEDIR> created!"
|
||||
SESSION_RELOAD_REQUIRED=true
|
||||
else
|
||||
echo "path <$MIAOU_BASEDIR> already loaded!"
|
||||
fi
|
||||
}
|
||||
|
||||
function ask_target() {
|
||||
PS3='Choose miaou target purpose: '
|
||||
foods=("Dev" "Beta" "Prod")
|
||||
select ans in "${foods[@]}"; do
|
||||
builtin echo "${ans^^}"
|
||||
break
|
||||
done
|
||||
}
|
||||
|
||||
function check_credential {
|
||||
local PREFIX="check:credential"
|
||||
|
||||
check_yaml_defined_value /etc/miaou/defaults.yaml 'credential.username' &&
|
||||
check_yaml_defined_value /etc/miaou/defaults.yaml 'credential.shadow' &&
|
||||
check_yaml_defined_value /etc/miaou/defaults.yaml 'credential.email' &&
|
||||
check_yaml_defined_value /etc/miaou/defaults.yaml 'credential.password'
|
||||
|
||||
}
|
||||
|
||||
function check_target() {
|
||||
case "${TARGET^^}" in
|
||||
DEV) ;;
|
||||
BETA) ;;
|
||||
PROD) ;;
|
||||
*)
|
||||
if [[ -f /etc/miaou/defaults.yaml ]]; then
|
||||
# load already defined target in expanded conf
|
||||
TARGET=$(grep -Es "^target:" /etc/miaou/defaults.yaml | cut -d ' ' -f2)
|
||||
else
|
||||
TARGET=$(ask_target)
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
TARGET=${TARGET,,} # downcase
|
||||
return 0
|
||||
}
|
||||
|
||||
function miaou_configfiles() {
|
||||
local PREFIX="miaou:config"
|
||||
|
||||
if [[ ! -d /etc/miaou ]]; then
|
||||
echo -n "configuration initializing ..."
|
||||
sudo mkdir -p /etc/miaou
|
||||
sudo chown "$USER" /etc/miaou
|
||||
PREFIX="" echoinfo OK
|
||||
fi
|
||||
|
||||
if [[ ! -f /etc/miaou/defaults.yaml ]]; then
|
||||
echo -n "building /etc/miaou/defaults.yaml for the first time..."
|
||||
shadow_passwd=$(sudo grep "$CURRENT_USER" /etc/shadow | cut -d ':' -f2)
|
||||
env current_user="$CURRENT_USER" shadow_passwd="$shadow_passwd" tera -e --env-key env --env-only -t "$MIAOU_BASEDIR/templates/etc/defaults.yaml.j2" -o /etc/miaou/defaults.yaml >/dev/null
|
||||
yq ".target=\"$TARGET\"" /etc/miaou/defaults.yaml -i
|
||||
PREFIX="" echoinfo OK
|
||||
fi
|
||||
|
||||
if [[ ! -f /etc/miaou/miaou.yaml ]]; then
|
||||
echo -n "building /etc/miaou/miaou.yaml for the first time..."
|
||||
cp "$MIAOU_BASEDIR/templates/etc/miaou.yaml.j2" /etc/miaou/miaou.yaml
|
||||
PREFIX="" echoinfo OK
|
||||
fi
|
||||
|
||||
PREVIOUS_TARGET=""
|
||||
echo "expanded configuration stored in <$MIAOU_CONFIGDIR>!"
|
||||
[[ -f "$EXPANDED_CONF" ]] && PREVIOUS_TARGET=$(grep -Es "^target:" "$EXPANDED_CONF" | cut -d ' ' -f2)
|
||||
|
||||
if [[ "$PREVIOUS_TARGET" != "$TARGET" ]]; then
|
||||
if [[ -z "$PREVIOUS_TARGET" ]]; then
|
||||
echo "new target defined <$TARGET>"
|
||||
else
|
||||
echowarnn "TARGET has changed from <$PREVIOUS_TARGET> to <$TARGET>, do you agree?"
|
||||
if askConfirmation N; then
|
||||
echowarn "removing previous settings, please restart <miaou> to apply changes"
|
||||
rm "$MIAOU_CONFIGDIR" -rf
|
||||
else
|
||||
echoerr "TARGET not accepted, exit"
|
||||
exit 102
|
||||
fi
|
||||
fi
|
||||
yq ".target=\"$TARGET\"" /etc/miaou/defaults.yaml -i
|
||||
else
|
||||
echo "target <$TARGET> already defined!"
|
||||
fi
|
||||
}
|
||||
|
||||
function opt_link() {
|
||||
if [[ $MIAOU_BASEDIR != '/opt/miaou' ]]; then
|
||||
if [[ -L '/opt/miaou' && -d '/opt/miaou' && $(readlink /opt/miaou) == "$MIAOU_BASEDIR" ]]; then
|
||||
echo "symbolic link /opt/miaou already set up!"
|
||||
else
|
||||
sudo rm -f /opt/miaou
|
||||
sudo ln -s "$MIAOU_BASEDIR" /opt/miaou
|
||||
echo "symbolic link /opt/miaou successfully defined!"
|
||||
fi
|
||||
else
|
||||
echo "real path /opt/miaou already set up!"
|
||||
fi
|
||||
}
|
||||
|
||||
function miaou_resolver() {
|
||||
local PREFIX="miaou:resolver"
|
||||
bridge=$(ip addr show lxdbr0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)
|
||||
gateway=$(ip route | grep default | cut -d' ' -f3)
|
||||
|
||||
if command -v nmcli &>/dev/null; then
|
||||
if [[ ! -f /etc/NetworkManager/dispatcher.d/50-miaou-resolver ]]; then
|
||||
echo -n "use NetworkManager dispatcher to deal with LXD bridge automatically..."
|
||||
sudo cp "$MIAOU_BASEDIR/templates/network-manager/50-miaou-resolver" /etc/NetworkManager/dispatcher.d/
|
||||
sudo chmod +x /etc/NetworkManager/dispatcher.d/50-miaou-resolver
|
||||
ACTIVE_CONNECTION=$(nmcli -g NAME connection show --active | head -n1)
|
||||
nmcli connection up "$ACTIVE_CONNECTION" &>/dev/null
|
||||
PREFIX="" echoinfo OK
|
||||
else
|
||||
echo "miaou-resolver in NetworkManager dispatcher already initialized!"
|
||||
fi
|
||||
else
|
||||
if ! grep -q "nameserver $bridge" /etc/resolv.conf; then
|
||||
echo "customize resolv.conf from scratch (SERVER)..."
|
||||
sudo tee /etc/resolv.conf &>/dev/null <<EOF
|
||||
nameserver $bridge
|
||||
nameserver $gateway
|
||||
EOF
|
||||
PREFIX="" echoinfo OK
|
||||
else
|
||||
echo "customize resolv.conf already already defined!"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
function extra_dev_desktop {
|
||||
# detect if DEV
|
||||
# detect if DESKTOP
|
||||
:
|
||||
}
|
||||
|
||||
function override_lxd_service_to_reload_nftables {
|
||||
local PREFIX="lxd:override"
|
||||
|
||||
if [[ ! -d /etc/systemd/system/lxd.service.d ]]; then
|
||||
echo -n "override lxd service..."
|
||||
sudo mkdir -p /etc/systemd/system/lxd.service.d
|
||||
cat <<EOF | sudo tee /etc/systemd/system/lxd.service.d/override.conf
|
||||
[Service]
|
||||
ExecStartPost=systemctl reload nftables.service
|
||||
EOF
|
||||
sudo systemctl daemon-reload
|
||||
PREFIX="" echo "OK"
|
||||
else
|
||||
echo "lxd service already overridden!"
|
||||
fi
|
||||
}
|
||||
|
||||
function ask_for_credential {
|
||||
local PREFIX="ask:credential"
|
||||
if ! check_credential 2>/dev/null; then
|
||||
echo "further details required, please replace any <TO BE DEFINED> by a proper value ...press any key to open editor"
|
||||
read -rn1
|
||||
editor /etc/miaou/defaults.yaml
|
||||
fi
|
||||
check_credential
|
||||
echo "successfully checked!"
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
if [[ "${1:-}" == "SESSION_RELOAD_REQUIRED" ]]; then
|
||||
SESSION_RELOAD_REQUIRED=true
|
||||
shift
|
||||
else
|
||||
SESSION_RELOAD_REQUIRED=false
|
||||
fi
|
||||
|
||||
if [[ "${1:-}" == "shellenv" ]]; then
|
||||
unset PREFIX
|
||||
echo "export MIAOU_BASEDIR=$MIAOU_BASEDIR"
|
||||
echo "export PATH=\"\$MIAOU_BASEDIR/scripts\":\$PATH"
|
||||
else
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
trap 'status=$?; on_exit; exit $status' EXIT
|
||||
trap 'trap - HUP; on_exit SIGHUP; kill -HUP $$' HUP
|
||||
trap 'trap - INT; on_exit SIGINT; kill -INT $$' INT
|
||||
trap 'trap - TERM; on_exit SIGTERM; kill -TERM $$' TERM
|
||||
|
||||
PREFIX="miaou"
|
||||
: $PREFIX
|
||||
TARGET=${1:-}
|
||||
CURRENT_USER=$(id -un)
|
||||
|
||||
check_target
|
||||
sudo_required
|
||||
install_debian_bash
|
||||
install_mandatory_commands
|
||||
prepare_toolbox
|
||||
add_toolbox_sudoers
|
||||
prepare_nftables
|
||||
prepare_lxd "$@"
|
||||
override_lxd_service_to_reload_nftables
|
||||
miaou_resolver
|
||||
miaou_evalfrombashrc
|
||||
miaou_configfiles
|
||||
ask_for_credential
|
||||
prepare_nftables
|
||||
opt_link
|
||||
extra_dev_desktop
|
||||
|
||||
if [[ "$SESSION_RELOAD_REQUIRED" == false ]]; then
|
||||
echoinfo "successful installation"
|
||||
else
|
||||
echowarn "please reload your session, .bashrc needs to be reloaded!"
|
||||
fi
|
||||
fi
|
||||
Executable
+218
@@ -0,0 +1,218 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_database_exists() {
|
||||
db-maria list | grep -q "$longname"
|
||||
}
|
||||
|
||||
function check_port_used() {
|
||||
# shellcheck disable=SC2034
|
||||
usedport=$(lxc exec "$container" -- bash -c "grep Listen /etc/apache2/sites-enabled/$longname.conf | cut -d' ' -f2")
|
||||
|
||||
[[ "$usedport" == "$port" ]]
|
||||
}
|
||||
|
||||
function check_service_running() {
|
||||
lxc exec "$container" -- bash -c "systemctl is-active --quiet apache2.service"
|
||||
}
|
||||
|
||||
function check_config_defined() {
|
||||
lxc exec "$container" -- bash -c "test -f /var/www/cagettepei/$shortname/config.xml"
|
||||
}
|
||||
|
||||
function _read() {
|
||||
disable_trace
|
||||
check_database_exists
|
||||
check_container "$container"
|
||||
check_port_used
|
||||
check_config_defined
|
||||
check_service_running
|
||||
enable_trace
|
||||
return 0
|
||||
}
|
||||
|
||||
function _create() {
|
||||
echo "creating CagettePéi instance for <$shortname> ... "
|
||||
|
||||
mkdir -p "$MIAOU_CONFIGDIR/apps/cagettepei"
|
||||
APP_PORT=$port APP_NAME=$shortname tera -e --env-key env -t "$MIAOU_DIR/templates/apps/cagettepei/cagettepei-host.j2" -o "$MIAOU_CONFIGDIR/apps/cagettepei/$longname.conf" "$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
echo "creating templates ... OK"
|
||||
|
||||
echo "copying files over container <$container> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/cagettepei/$longname.conf" "$container/etc/apache2/sites-available/$longname.conf"
|
||||
echo "copying files over container <$container> ... OK"
|
||||
|
||||
if ! (db-maria list | grep -q "$longname"); then
|
||||
echo "create empty database <$longname> ... "
|
||||
db-maria create "$longname"
|
||||
echo "create empty database <$longname> ... OK"
|
||||
DB_INIT=true
|
||||
else
|
||||
echo "database already exists!"
|
||||
DB_INIT=false
|
||||
fi
|
||||
|
||||
credential_username=$(load_yaml_from_expanded credential.username)
|
||||
credential_email=$(load_yaml_from_expanded credential.email)
|
||||
|
||||
echo "initialize cagettepei $shortname $longname ..."
|
||||
lxc exec "$container" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
if [[ ! -d /var/www/cagettepei/$shortname ]]; then
|
||||
echo "installing new instance of cagettepei into /var/www/cagettepei/$shortname"
|
||||
cd /tmp
|
||||
if [[ -d cagettepei ]]; then
|
||||
echo "refreshing previous clone"
|
||||
cd cagettepei
|
||||
git pull
|
||||
cd ..
|
||||
else
|
||||
echo "cloning"
|
||||
git clone https://git.artcode.re/cagetters/cagettepei.git
|
||||
fi
|
||||
cp -r cagettepei /var/www/cagettepei/$shortname
|
||||
cd /var/www/cagettepei/$shortname
|
||||
echo COMPILING...
|
||||
export HAXE_STD_PATH=/opt/haxe_20180221160843_bb7b827/std
|
||||
haxelib setup .haxelib
|
||||
make install ENV=dev
|
||||
echo OK
|
||||
else
|
||||
echo "instance of cagettepei /var/www/cagettepei/$shortname already defined!"
|
||||
fi
|
||||
|
||||
if diff -q /var/www/cagettepei/$shortname/config.xml /var/www/cagettepei/$shortname/config.xml.dist; then
|
||||
echo "create config.xml"
|
||||
cat << 'EOT2' > /var/www/cagettepei/$shortname/config.xml
|
||||
<config
|
||||
database="mysql://cagettepei-$shortname:cagettepei-$shortname@ct1.lxd/cagettepei-$shortname"
|
||||
|
||||
host="$fqdn"
|
||||
name = "$shortname"
|
||||
default_email = "postmaster@artcode.re"
|
||||
webmaster_email = "postmaster@artcode.re"
|
||||
|
||||
key="carotteMagique"
|
||||
|
||||
lang="fr"
|
||||
langs="fr"
|
||||
langnames="Français"
|
||||
sqllog="0"
|
||||
debug="0"
|
||||
cache="0"
|
||||
maintain="0"
|
||||
cachetpl="0"
|
||||
/>
|
||||
EOT2
|
||||
else
|
||||
echo "config.xml already defined!"
|
||||
fi
|
||||
|
||||
a2ensite $longname.conf
|
||||
mkdir -p /var/log/apache2/cagettepei/$shortname
|
||||
systemctl restart apache2
|
||||
|
||||
if [[ $DB_INIT == true ]]; then
|
||||
echo "Force TABLES initialization"
|
||||
curl localhost:$port
|
||||
echo "Set administrator password..."
|
||||
echo "insert into User values (1,'fr','c3513c793b13471f3a49bdb22acb66de',1,'$credential_username','Admin', '$credential_email', null, null, null, null, null, null, null, null, null, now(), now(),6,null, null);" | mariadb cagettepei-$shortname -u cagettepei-$shortname -pcagettepei-$shortname -h ct1.lxd
|
||||
echo "TODO: password \`cagette\` should be changed soon!!!"
|
||||
fi
|
||||
EOF
|
||||
echo "initialize cagettepei $shortname $longname ... OK"
|
||||
}
|
||||
|
||||
function _update() {
|
||||
echo "update"
|
||||
}
|
||||
|
||||
function _delete() {
|
||||
echo "delete"
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo "Usage: $COMMAND_NAME -c|r|u|d --port PORT --container CONTAINER --name NAME"
|
||||
exit 2
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
# init_strict
|
||||
|
||||
COMMAND_NAME=$(basename "$0")
|
||||
|
||||
# read the options
|
||||
|
||||
TEMP=$(getopt -n "$COMMAND_NAME" -o crud --long port:,container:,name:,fqdn: -- "$@")
|
||||
# shellcheck disable=SC2181
|
||||
[[ "$?" -eq 0 ]] || usage
|
||||
eval set -- "$TEMP"
|
||||
|
||||
action="unset"
|
||||
port="unset"
|
||||
container="unset"
|
||||
shortname="unset"
|
||||
longname="unset"
|
||||
fqdn="unset"
|
||||
|
||||
# extract options and their arguments into variables.
|
||||
while true; do
|
||||
case "$1" in
|
||||
--port)
|
||||
port=$2
|
||||
shift 2
|
||||
;;
|
||||
--fqdn)
|
||||
fqdn=$2
|
||||
shift 2
|
||||
;;
|
||||
--container)
|
||||
container=$2
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
shortname=$2
|
||||
longname="cagettepei-$shortname"
|
||||
shift 2
|
||||
;;
|
||||
-c)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_create"
|
||||
shift 1
|
||||
;;
|
||||
-r)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_read"
|
||||
shift 1
|
||||
;;
|
||||
-u)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_update"
|
||||
shift 1
|
||||
;;
|
||||
-d)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_delete"
|
||||
shift 1
|
||||
;;
|
||||
--)
|
||||
shift
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Internal error!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[
|
||||
"$action" != unset &&
|
||||
"$port" != unset &&
|
||||
"$container" != unset &&
|
||||
"$fqdn" != unset &&
|
||||
"$shortname" != unset ]] || usage
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
$action
|
||||
Executable
+187
@@ -0,0 +1,187 @@
|
||||
#!/bin/bash
|
||||
|
||||
readonly UNWANTED_PACKAGES_STRING="nginx node python haxe"
|
||||
readonly MANDATORY_PACKAGES_STRING="wget apache2 make git imagemagick gettext libapache2-mod-neko mariadb-client sendemail libio-socket-ssl-perl libnet-ssleay-perl"
|
||||
|
||||
### CHECK
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:cagettepei:check"
|
||||
check_unwanted_packages || return 21
|
||||
check_mandatory_packages || return 22
|
||||
check_apache_modules || return 23
|
||||
check_node8 || return 24
|
||||
check_python2 || return 25
|
||||
check_haxe3 || return 26
|
||||
check_cagettepei_batch || return 35
|
||||
check_cagettepei_timers || return 36
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
}
|
||||
|
||||
function check_apache_modules() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
test -L /etc/apache2/mods-enabled/neko.load
|
||||
test -L /etc/apache2/mods-enabled/rewrite.load
|
||||
true
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_cagettepei_batch() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
test -f /var/www/cagettepei/cagettepei-batch
|
||||
true
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_cagettepei_timers() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
test -f /etc/systemd/system/cagettepei-batch-minute.service
|
||||
test -f /etc/systemd/system/cagettepei-batch-minute.timer
|
||||
test -f /etc/systemd/system/cagettepei-batch-day.service
|
||||
test -f /etc/systemd/system/cagettepei-batch-day.timer
|
||||
true
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_node8() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
node --version | grep -q 'v8.17.0'
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_python2() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
python --version 2>&1 | grep -q 'Python 2.7.18'
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_haxe3() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
haxe -version 2>&1 | grep -q '3.4.7'
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_unwanted_packages() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
mapfile -t PACKAGES <<< "$UNWANTED_PACKAGES_STRING"
|
||||
for package in \${PACKAGES[@]}; do
|
||||
! (dpkg -l "\$package" 2>/dev/null | grep -q ^ii)
|
||||
done
|
||||
true # useful because for might return last inexistant package
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_mandatory_packages() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
mapfile -t PACKAGES <<< "$MANDATORY_PACKAGES_STRING"
|
||||
for package in \${PACKAGES[@]}; do
|
||||
dpkg-query -l "\$package" 2>/dev/null | grep -q ^ii
|
||||
done
|
||||
EOF
|
||||
}
|
||||
|
||||
### INSTALL
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:cagettepei:install"
|
||||
: $PREFIX
|
||||
|
||||
launch_container "$CONTAINER"
|
||||
echo "initializing CagettePéi ... "
|
||||
|
||||
echo -n "check unwanted packages..."
|
||||
check_unwanted_packages
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
|
||||
echo installing CagettePéi...
|
||||
apt-get update
|
||||
apt-get install -y $MANDATORY_PACKAGES_STRING
|
||||
|
||||
echo installing custom Node8...
|
||||
wget https://nodejs.org/download/release/v8.17.0/node-v8.17.0-linux-x64.tar.gz -O /tmp/node-v8.17.0-linux-x64.tar.gz
|
||||
tar -xzvf /tmp/node-v8.17.0-linux-x64.tar.gz -C /opt
|
||||
chown root:root -R /opt/node-v8.17.0-linux-x64
|
||||
ln -sf /opt/node-v8.17.0-linux-x64/bin/node /usr/local/bin/
|
||||
ln -sf /opt/node-v8.17.0-linux-x64/bin/npm /usr/local/bin/
|
||||
echo -n DONE
|
||||
|
||||
echo installing custom Python2 with pypy...
|
||||
wget https://downloads.python.org/pypy/pypy2.7-v7.3.13-linux64.tar.bz2 -O /tmp/pypy2.7-v7.3.13-linux64.tar.bz2
|
||||
apt install -y bzip2
|
||||
bunzip2 -f /tmp/pypy2.7-v7.3.13-linux64.tar.bz2
|
||||
tar -xvf /tmp/pypy2.7-v7.3.13-linux64.tar -C /opt
|
||||
ln -sf /opt/pypy2.7-v7.3.13-linux64/bin/python /usr/local/bin/
|
||||
ln -sf /opt/pypy2.7-v7.3.13-linux64/bin/python2 /usr/local/bin/
|
||||
echo -n DONE
|
||||
|
||||
echo installing custom Haxe3...
|
||||
wget https://github.com/HaxeFoundation/haxe/releases/download/3.4.7/haxe-3.4.7-linux64.tar.gz -O /tmp/haxe-3.4.7-linux64.tar.gz
|
||||
tar -xzvf /tmp/haxe-3.4.7-linux64.tar.gz -C /opt
|
||||
ln -sf /opt/haxe_20180221160843_bb7b827/haxe /usr/local/bin/
|
||||
ln -sf /opt/haxe_20180221160843_bb7b827/haxelib /usr/local/bin/
|
||||
echo -n DONE
|
||||
|
||||
systemctl stop apache2
|
||||
rm -f /etc/apache2/sites-available/{000-default,default-ssl}.conf
|
||||
rm -f /etc/apache2/sites-enabled/000-default.conf
|
||||
rm -rf /var/www/html
|
||||
sed -i '/<Directory \/var\/www\/>/,/<\/Directory>/ s/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf
|
||||
sed -i 's/^Listen 80$//' /etc/apache2/ports.conf
|
||||
|
||||
echo "prepare folder for cagettepei instances"
|
||||
mkdir -p /var/www/cagettepei
|
||||
|
||||
echo "enable neko and rewrite apache2 modules"
|
||||
a2enmod neko
|
||||
a2enmod rewrite
|
||||
EOF
|
||||
|
||||
echo -n "copy cagettepei-batch..."
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/cagettepei/cagettepei-batch" "$CONTAINER/var/www/cagettepei/cagettepei-batch"
|
||||
lxc exec "$CONTAINER" -- chmod +x /var/www/cagettepei/cagettepei-batch
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
echo -n "copy cagettepei timers in systemd..."
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/cagettepei/systemd/cagettepei-batch-minute.service" "$CONTAINER/etc/systemd/system/cagettepei-batch-minute.service"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/cagettepei/systemd/cagettepei-batch-minute.timer" "$CONTAINER/etc/systemd/system/cagettepei-batch-minute.timer"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/cagettepei/systemd/cagettepei-batch-day.service" "$CONTAINER/etc/systemd/system/cagettepei-batch-day.service"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/cagettepei/systemd/cagettepei-batch-day.timer" "$CONTAINER/etc/systemd/system/cagettepei-batch-day.timer"
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
echo -n "override apache2 service to launch cagettepei timers..."
|
||||
lxc exec "$CONTAINER" -- bash -c "SYSTEMD_EDITOR=tee systemctl edit apache2 <<EOT
|
||||
[Unit]
|
||||
BindsTo = cagettepei-batch-minute.timer cagettepei-batch-day.timer
|
||||
EOT"
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
echo "enable and start cagettepei timers in systemd..."
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
systemctl enable cagettepei-batch-minute.timer cagettepei-batch-day.timer
|
||||
systemctl start cagettepei-batch-minute.timer cagettepei-batch-day.timer
|
||||
EOF
|
||||
PREFIX="" echo "OK"
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+124
@@ -0,0 +1,124 @@
|
||||
#!/bin/bash
|
||||
|
||||
readonly EXPANDED_CONF="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
|
||||
TARGET=$(yq '.target' "$EXPANDED_CONF")
|
||||
readonly TARGET
|
||||
|
||||
function check() {
|
||||
container_exists "$CONTAINER" || return 1
|
||||
container_running "$CONTAINER" || return 2
|
||||
check_reverseproxy || return 4
|
||||
check_banner || return 5
|
||||
check_certbot || return 6
|
||||
|
||||
PREFIX="recipe:dmz:check" echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_reverseproxy() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
dpkg -l nginx | grep -q ^ii
|
||||
systemctl is-active --quiet nginx
|
||||
nginx -tq
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_certbot() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
dpkg -l certbot | grep -q ^ii
|
||||
dpkg -l python3-certbot-nginx | grep -q ^ii
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_banner() {
|
||||
if [[ $TARGET != "prod" ]]; then
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
test -f /etc/nginx/snippets/banner_$TARGET.conf
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:dmz:install"
|
||||
: $PREFIX
|
||||
|
||||
echowarn "about to deploy new container <$CONTAINER> ..."
|
||||
|
||||
if ! container_exists "$CONTAINER"; then
|
||||
echowarn "about to create new container <$CONTAINER> ..."
|
||||
lxc-miaou-create "$CONTAINER"
|
||||
echo OK
|
||||
fi
|
||||
|
||||
if ! container_running "$CONTAINER"; then
|
||||
echowarn "about to start asleep container <$CONTAINER> ..."
|
||||
lxc start "$CONTAINER"
|
||||
echo OK
|
||||
fi
|
||||
|
||||
credential_email=$(load_yaml_from_expanded credential.email)
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
apt-get update && apt-get dist-upgrade -y
|
||||
apt-get install -y nginx ssl-cert libnginx-mod-http-subs-filter certbot python3-certbot-nginx
|
||||
|
||||
echo "registering with your default credential email <$credential_email>"
|
||||
certbot register --agree-tos --email $credential_email --no-eff-email || echo "already resgistered!"
|
||||
|
||||
rm /etc/nginx/sites-{enabled,available}/default -f
|
||||
systemctl enable nginx
|
||||
|
||||
nginx -tq || rm /etc/nginx/sites-enabled/hosts
|
||||
systemctl start nginx
|
||||
EOF
|
||||
|
||||
if [[ "$TARGET" != "prod" ]]; then
|
||||
echo "copying Nginx banner to container <$CONTAINER> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/nginx/snippets/banner_$TARGET.conf" "$CONTAINER/etc/nginx/snippets/banner_$TARGET.conf"
|
||||
echo "copying files over container <$CONTAINER> ... OK"
|
||||
else
|
||||
echo "no Nginx banner on PROD!"
|
||||
fi
|
||||
|
||||
echo "populate nftables entries into yaml"
|
||||
local wan_interface dmz_ip
|
||||
wan_interface=$(ip route show default | cut -d ' ' -f5)
|
||||
dmz_ip=$(host "$CONTAINER.lxd" | cut -d ' ' -f4)
|
||||
yq ".nftables.wan_interface=\"$wan_interface\"" "$EXPANDED_CONF" -i
|
||||
yq ".nftables.dmz_ip=\"$dmz_ip\"" "$EXPANDED_CONF" -i
|
||||
|
||||
local nftables_reloading=false
|
||||
if [[ "$TARGET" != "dev" ]]; then
|
||||
mkdir -p "$MIAOU_CONFIGDIR/nftables.rules.d"
|
||||
echo "nat http/s port to dmz"
|
||||
tera -t "$MIAOU_BASEDIR/templates/nftables/nat.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/nat.table" &>/dev/null
|
||||
sudo cp "$MIAOU_CONFIGDIR/nftables.rules.d/nat.table" /etc/nftables.rules.d/nat.table
|
||||
nftables_reloading=true
|
||||
else
|
||||
if [[ -f /etc/nftables.rules.d/nat.table ]]; then
|
||||
sudo_required "remove previous nat.table"
|
||||
sudo rm -f /etc/nftables.rules.d/nat.table
|
||||
nftables_reloading=true
|
||||
fi
|
||||
fi
|
||||
if [[ "$nftables_reloading" == true ]]; then
|
||||
sudo_required "reload nftables"
|
||||
sudo systemctl reload nftables.service
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
# MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check() {
|
||||
echowarn "recipe:dokuwiki not yet checked!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function install() {
|
||||
echowarn "recipe:dokuwiki not yet initialized!"
|
||||
}
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
launch_container "$CONTAINER"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+180
@@ -0,0 +1,180 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_database_exists() {
|
||||
db-psql list | grep -q "$longname"
|
||||
}
|
||||
|
||||
function check_port_used() {
|
||||
# shellcheck disable=SC2034
|
||||
usedport=$(lxc exec "$container" -- cat /etc/nginx/sites-enabled/"$longname".conf | grep listen | cut -d ' ' -f2)
|
||||
[[ "$usedport" == "$port" ]]
|
||||
}
|
||||
|
||||
function check_directory_exists() {
|
||||
lxc exec "$container" -- test -d /var/www/"$longname"
|
||||
}
|
||||
|
||||
function check_service_running() {
|
||||
lxc exec "$container" -- bash -c "systemctl is-active --quiet nginx.service"
|
||||
}
|
||||
|
||||
function _read() {
|
||||
disable_trace
|
||||
check_database_exists
|
||||
check_container "$container"
|
||||
check_port_used
|
||||
check_directory_exists
|
||||
check_service_running
|
||||
enable_trace
|
||||
return 0
|
||||
}
|
||||
|
||||
function _create() {
|
||||
PREFIX="recipe:dolibarr:create"
|
||||
: $PREFIX
|
||||
|
||||
echo "create a Dolibarr instance for $shortname"
|
||||
|
||||
lxc exec "$container" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
echo "install latest release ... "
|
||||
cd /var/www
|
||||
PATH="\$PATH:/opt/debian-bash/tools"
|
||||
VERSION="\$(wget_semver github Dolibarr/dolibarr)"
|
||||
if [[ ! -f "dolibarr-\$VERSION.tgz" ]]; then
|
||||
wget_release github Dolibarr/dolibarr
|
||||
else
|
||||
echo "dolibarr version=\$VERSION already downloaded!"
|
||||
fi
|
||||
|
||||
if [[ ! -d "$longname" ]]; then
|
||||
tar -xzvf "dolibarr-\$VERSION.tgz"
|
||||
mv dolibarr-\$VERSION $longname
|
||||
chown www-data:www-data -R $longname
|
||||
else
|
||||
echo "$longname already created!"
|
||||
fi
|
||||
|
||||
EOF
|
||||
|
||||
echo "generating configuration files from templates... "
|
||||
mkdir -p "$MIAOU_CONFIGDIR/apps/dolibarr/$shortname"
|
||||
PHP_VERSION=$(lxc exec "$container" -- dpkg -l php-fpm | grep "^ii" | cut -d ':' -f2 | cut -d '+' -f1)
|
||||
APP_PORT=$port APP_NAME=$longname PHP_VERSION=$PHP_VERSION tera -e -t "$MIAOU_DIR/templates/apps/dolibarr/host.j2" -o "$MIAOU_CONFIGDIR/apps/dolibarr/$shortname/host.conf" "$MIAOU_CONFIGDIR/miaou.expanded.yaml" >/dev/null
|
||||
|
||||
echo "copying configuration files onto container <$container>... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/dolibarr/$shortname/host.conf" "$container/etc/nginx/sites-available/$longname.conf"
|
||||
echo "copying files over container <$container> ... OK"
|
||||
|
||||
if ! (db-psql list | grep -q "$longname"); then
|
||||
echo "create empty database <$longname> ... "
|
||||
db-psql create "$longname"
|
||||
echo "create empty database <$longname> ... OK"
|
||||
|
||||
else
|
||||
echo "database already exists!"
|
||||
fi
|
||||
|
||||
echo "enable host config..."
|
||||
lxc exec "$container" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
cd /etc/nginx/sites-enabled
|
||||
ln -sf ../sites-available/$longname.conf
|
||||
mkdir -p /var/log/nginx/$longname
|
||||
nginx -t
|
||||
systemctl reload nginx
|
||||
EOF
|
||||
echo "enable host config... OK"
|
||||
}
|
||||
|
||||
function _update() {
|
||||
echo "TODO: update"
|
||||
}
|
||||
|
||||
function _delete() {
|
||||
echo "TODO: delete"
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo "Usage: $COMMAND_NAME -c|r|u|d --port PORT --container CONTAINER --name NAME"
|
||||
exit 2
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
# init_strict
|
||||
|
||||
COMMAND_NAME=$(basename "$0")
|
||||
|
||||
# read the options
|
||||
|
||||
TEMP=$(getopt -n "$COMMAND_NAME" -o crud --long port:,container:,name:,fqdn: -- "$@")
|
||||
# shellcheck disable=SC2181
|
||||
[[ "$?" -eq 0 ]] || usage
|
||||
eval set -- "$TEMP"
|
||||
|
||||
action="unset"
|
||||
port="unset"
|
||||
container="unset"
|
||||
shortname="unset"
|
||||
longname="unset"
|
||||
|
||||
# extract options and their arguments into variables.
|
||||
while true; do
|
||||
case "$1" in
|
||||
--port)
|
||||
port=$2
|
||||
shift 2
|
||||
;;
|
||||
--fqdn)
|
||||
shift 2
|
||||
;;
|
||||
--container)
|
||||
container=$2
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
shortname=$2
|
||||
longname="dolibarr-$shortname"
|
||||
shift 2
|
||||
;;
|
||||
-c)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_create"
|
||||
shift 1
|
||||
;;
|
||||
-r)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_read"
|
||||
shift 1
|
||||
;;
|
||||
-u)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_update"
|
||||
shift 1
|
||||
;;
|
||||
-d)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_delete"
|
||||
shift 1
|
||||
;;
|
||||
--)
|
||||
shift
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Internal error!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[
|
||||
"$action" != unset &&
|
||||
"$port" != unset &&
|
||||
"$container" != unset &&
|
||||
"$shortname" != unset ]] || usage
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
$action
|
||||
Executable
+56
@@ -0,0 +1,56 @@
|
||||
#!/bin/bash
|
||||
|
||||
MANDATORY_PACKAGES_STRING="nginx php-fpm postgresql-client php-pgsql php-intl php-curl php-gd php-zip php-imap php-xml php-mbstring"
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:dolibarr:check"
|
||||
: $PREFIX
|
||||
|
||||
check_mandatory_packages || return 11
|
||||
check_one_release || return 12
|
||||
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_mandatory_packages() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
mapfile -t PACKAGES <<< "$MANDATORY_PACKAGES_STRING"
|
||||
for package in \${PACKAGES[@]}; do
|
||||
dpkg -l "\$package" 2>/dev/null | grep -q ^ii
|
||||
done
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_one_release() {
|
||||
lxc exec "$CONTAINER" -- /TOOLBOX/fd -1q -tf "dolibarr-" /var/www
|
||||
}
|
||||
|
||||
function install() {
|
||||
echo "recipe:dolibarr installing..."
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
cloud-init status --wait >/dev/null
|
||||
apt update
|
||||
apt install -y $MANDATORY_PACKAGES_STRING
|
||||
cd /var/www
|
||||
PATH="\$PATH:/opt/debian-bash/tools"
|
||||
VERSION="\$(wget_semver github Dolibarr/dolibarr)"
|
||||
if [[ ! -f "dolibarr-\$VERSION.tgz" ]]; then
|
||||
wget_release github Dolibarr/dolibarr
|
||||
else
|
||||
echo "dolibarr version=\$VERSION already downloaded!"
|
||||
fi
|
||||
EOF
|
||||
}
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
launch_container "$CONTAINER"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+65
@@ -0,0 +1,65 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:mariadb:check"
|
||||
dpkg -l mariadb-client | grep -q ^ii || return 9
|
||||
container_running "$CONTAINER" || return 10
|
||||
cat <<EOF | lxc_exec "$CONTAINER" || return 20
|
||||
set -Eeuo pipefail
|
||||
systemctl is-active mariadb.service &>/dev/null
|
||||
ss -tlnp | grep 0.0.0.0:3306 | grep -q maria
|
||||
|
||||
test -f /etc/default/automysqlbackup
|
||||
grep -q BACKUPDIR=\"/mnt/BACKUP/mariadb\" /etc/default/automysqlbackup
|
||||
EOF
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function build_device_backup() {
|
||||
PREFIX="recipe:mariadb:backup"
|
||||
if ! (lxc config device list "$CONTAINER" | grep -q BACKUP); then
|
||||
local backup_dir="$HOME/LXD/BACKUP/databases-$CONTAINER"
|
||||
mkdir -p "$backup_dir"
|
||||
lxc config device add "$CONTAINER" BACKUP disk source=$backup_dir path=mnt/BACKUP
|
||||
fi
|
||||
}
|
||||
|
||||
function install() {
|
||||
sudo_required
|
||||
PREFIX="recipe:mariadb:install"
|
||||
: $PREFIX
|
||||
|
||||
sudo /opt/debian-bash/tools/idem_apt_install mariadb-client
|
||||
echowarn "initializing ..."
|
||||
launch_container "$CONTAINER"
|
||||
build_device_backup
|
||||
echowarn "executing various commands onto container <$CONTAINER>, please be patient ..."
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
cloud-init status --wait >/dev/null
|
||||
. /opt/debian-bash/lib/functions.sh
|
||||
apt update && apt dist-upgrade -y
|
||||
/opt/debian-bash/tools/idem_apt_install mariadb-server automysqlbackup
|
||||
echo "change bind-adress"
|
||||
/opt/debian-bash/tools/append_or_replace "^bind-address.*$" "bind-address = 0.0.0.0" /etc/mysql/mariadb.conf.d/50-server.cnf
|
||||
systemctl restart mariadb.service
|
||||
|
||||
function systemctl-exists() ([ \$(systemctl list-unit-files "\${1}*" | wc -l) -gt 3 ])
|
||||
systemctl-exists exim4.service && systemctl stop exim4.service && systemctl disable exim4.service
|
||||
/opt/debian-bash/tools/append_or_replace "^BACKUPDIR=.*$" "BACKUPDIR=\"/mnt/BACKUP/mariadb\"" /etc/default/automysqlbackup
|
||||
exit 0
|
||||
EOF
|
||||
echo DONE
|
||||
}
|
||||
|
||||
# MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+180
@@ -0,0 +1,180 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_database_exists() {
|
||||
db-psql list | grep -q "$longname"
|
||||
}
|
||||
|
||||
function check_port_used() {
|
||||
# shellcheck disable=SC2034
|
||||
usedport=$(lxc exec "$container" -- bash -c "grep xmlrpc_port /etc/odoo12/$shortname.conf | cut -d' ' -f3")
|
||||
[[ "$usedport" == "$port" ]]
|
||||
}
|
||||
|
||||
function check_service_running() {
|
||||
lxc exec "$container" -- bash -c "systemctl is-active --quiet ${longname}.service"
|
||||
}
|
||||
|
||||
function _read() {
|
||||
disable_trace
|
||||
check_database_exists
|
||||
check_container "$container"
|
||||
check_port_used
|
||||
check_service_running
|
||||
enable_trace
|
||||
return 0
|
||||
}
|
||||
|
||||
function _create() {
|
||||
|
||||
echo "creating templates ... "
|
||||
mkdir -p "$MIAOU_CONFIGDIR/apps/odoo12"
|
||||
|
||||
longport=$((port + 1000))
|
||||
APP_PORT=$port LONG_PORT=$longport APP_NAME=$shortname tera -e -t "$MIAOU_DIR/templates/apps/odoo12/odoo.conf.j2" -o "$MIAOU_CONFIGDIR/apps/odoo12/$shortname.conf" "$MIAOU_CONFIGDIR/miaou.expanded.yaml" >/dev/null
|
||||
APP_NAME=$shortname tera -t "$MIAOU_DIR/templates/apps/odoo12/odoo.service.j2" --env-only -o "$MIAOU_CONFIGDIR/apps/odoo12/$longname.service" >/dev/null
|
||||
echo "creating templates ... OK"
|
||||
|
||||
echo "copying files over container <$container> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/odoo12/$shortname.conf" "$container/etc/odoo12/$shortname.conf"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/odoo12/$longname.service" "$container/etc/systemd/system/$longname.service"
|
||||
echo "copying files over container <$container> ... OK"
|
||||
|
||||
if ! (db-psql list | grep -q "$longname"); then
|
||||
echo "create empty database <$longname> ... "
|
||||
db-psql create "$longname"
|
||||
echo "create empty database <$longname> ... OK"
|
||||
|
||||
credential_username=$(load_yaml_from_expanded credential.username)
|
||||
credential_password=$(load_yaml_from_expanded credential.password)
|
||||
cat <<EOF | lxc_exec "$container"
|
||||
set -Eeuo pipefail
|
||||
echo reloading systemd
|
||||
systemctl daemon-reload
|
||||
systemctl stop $longname
|
||||
|
||||
echo initialize database...
|
||||
su odoo -c "/home/odoo/venv/bin/python3 /home/odoo/odoo12/odoo-bin -c /etc/odoo12/$shortname.conf -i base --without-demo=all --stop-after-init"
|
||||
echo initialize database OK
|
||||
|
||||
echo install default modules ...
|
||||
su odoo -c "/home/odoo/venv/bin/python3 /home/odoo/odoo12/odoo-bin -c /etc/odoo12/$shortname.conf -i account,contacts,l10n_fr,account,sale,point_of_sale -d $longname --worker=0 --stop-after-init"
|
||||
echo default modules OK
|
||||
|
||||
chmod u+w -R "/home/odoo/data-$shortname"
|
||||
|
||||
echo "TODO: change administrator password, default credential applied!"
|
||||
echo "UPDATE res_users SET login='$credential_username', password='$credential_password' WHERE id=2" | PGPASSWORD=$longname psql -U $longname -h ct1.lxd
|
||||
EOF
|
||||
else
|
||||
echo "database already exists!"
|
||||
fi
|
||||
|
||||
echo "initialize odoo $shortname $longname ..."
|
||||
cat <<EOF | lxc_exec "$container"
|
||||
set -Eeuo pipefail
|
||||
echo reloading systemd
|
||||
systemctl daemon-reload
|
||||
|
||||
if ! systemctl is-active --quiet $longname; then
|
||||
echo start service $longname
|
||||
systemctl start $longname
|
||||
systemctl is-active --quiet $longname
|
||||
systemctl enable $longname
|
||||
else
|
||||
echo service $longname already started!
|
||||
fi
|
||||
EOF
|
||||
echo "initialize odoo $shortname $longname ... OK"
|
||||
}
|
||||
|
||||
function _update() {
|
||||
echo "TODO: update"
|
||||
}
|
||||
|
||||
function _delete() {
|
||||
echo "TODO: delete"
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo "Usage: $COMMAND_NAME -c|r|u|d --port PORT --container CONTAINER --name NAME"
|
||||
exit 2
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
# init_strict
|
||||
|
||||
COMMAND_NAME=$(basename "$0")
|
||||
|
||||
# read the options
|
||||
|
||||
TEMP=$(getopt -n "$COMMAND_NAME" -o crud --long port:,container:,name:,fqdn: -- "$@")
|
||||
# shellcheck disable=SC2181
|
||||
[[ "$?" -eq 0 ]] || usage
|
||||
eval set -- "$TEMP"
|
||||
|
||||
action="unset"
|
||||
port="unset"
|
||||
container="unset"
|
||||
shortname="unset"
|
||||
longname="unset"
|
||||
|
||||
# extract options and their arguments into variables.
|
||||
while true; do
|
||||
case "$1" in
|
||||
--port)
|
||||
port=$2
|
||||
shift 2
|
||||
;;
|
||||
--fqdn)
|
||||
shift 2
|
||||
;;
|
||||
--container)
|
||||
container=$2
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
shortname=$2
|
||||
longname="odoo12-$shortname"
|
||||
shift 2
|
||||
;;
|
||||
-c)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_create"
|
||||
shift 1
|
||||
;;
|
||||
-r)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_read"
|
||||
shift 1
|
||||
;;
|
||||
-u)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_update"
|
||||
shift 1
|
||||
;;
|
||||
-d)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_delete"
|
||||
shift 1
|
||||
;;
|
||||
--)
|
||||
shift
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Internal error!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[
|
||||
"$action" != unset &&
|
||||
"$port" != unset &&
|
||||
"$container" != unset &&
|
||||
"$shortname" != unset ]] || usage
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
$action
|
||||
Executable
+158
@@ -0,0 +1,158 @@
|
||||
#!/bin/bash
|
||||
|
||||
readonly EXPANDED_CONF="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
readonly WKHTML_VERSION="0.12.6-1"
|
||||
readonly WKHTML_RELEASE="$WKHTML_VERSION.buster_amd64"
|
||||
|
||||
function check_user_odoo() {
|
||||
(lxc exec "$CONTAINER" -- id odoo &>/dev/null) || return 12
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_target_bgcolor() {
|
||||
(lxc exec "$CONTAINER" -- grep -Pq "^\\\$o-community-color: $BACKGROUND_COLOR" /home/odoo/odoo12/addons/web/static/src/scss/primary_variables.scss) || return 13
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_wkhtmltox() {
|
||||
(lxc exec "$CONTAINER" -- dpkg -l | grep -s wkhtmltox | grep -qs $WKHTML_VERSION) || return 1
|
||||
}
|
||||
|
||||
function check_python() {
|
||||
(lxc exec "$CONTAINER" -- test -d /opt/Python-3.7.13) || return 1
|
||||
}
|
||||
|
||||
function check_venv() {
|
||||
(lxc exec "$CONTAINER" -- test -d /home/odoo/venv) || return 1
|
||||
}
|
||||
|
||||
function check_favicon() {
|
||||
lxc exec "$CONTAINER" -- test -L /home/odoo/odoo12/addons/web/static/src/img/favicon.ico
|
||||
}
|
||||
|
||||
function check_file_odoo-addon-install() {
|
||||
(lxc exec "$CONTAINER" -- test -f /home/odoo/odoo12/odoo12-addon-install) || return 23
|
||||
}
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:odoo12:check"
|
||||
check_wkhtmltox || return 10
|
||||
check_python || return 11
|
||||
check_user_odoo || return 12
|
||||
check_target_bgcolor || return 13
|
||||
check_venv || return 14
|
||||
check_favicon || return 15
|
||||
check_file_odoo-addon-install || return 23
|
||||
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:odoo12:install"
|
||||
: $PREFIX
|
||||
|
||||
launch_container "$CONTAINER"
|
||||
echo "initializing Odoo12 ... "
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
echo "installing odoo12..."
|
||||
apt-get update && apt-get dist-upgrade -y
|
||||
|
||||
if dpkg -l | grep -s wkhtmltox | grep -qs $WKHTML_VERSION; then
|
||||
echo package=wkhtmltox version=$WKHTML_RELEASE already found!
|
||||
else
|
||||
echo "wkhtmltox version=$WKHTML_RELEASE has to be installed!"
|
||||
wget https://github.com/wkhtmltopdf/packaging/releases/download/$WKHTML_VERSION/wkhtmltox_$WKHTML_RELEASE.deb
|
||||
dpkg -i wkhtmltox_$WKHTML_RELEASE.deb || (apt -fy install && rm wkhtmltox_$WKHTML_RELEASE.deb)
|
||||
fi
|
||||
|
||||
if [[ ! -d /opt/Python-3.7.13 ]]; then
|
||||
echo "installing Python-3.7.13..."
|
||||
apt-get install -y zlib1g-dev python3-pip python3-venv xz-utils build-essential libssl-dev python3-dev libxml2-dev libxslt1-dev libldap2-dev libsasl2-dev libpq-dev libffi-dev postgresql-client
|
||||
wget -O- https://www.python.org/ftp/python/3.7.13/Python-3.7.13.tar.xz | tar -xJ -C /opt
|
||||
chown -R root:root /opt/Python-3.7.13
|
||||
cd /opt/Python-3.7.13
|
||||
./configure --enable-optimizations --enable-shared
|
||||
make -j8 altinstall
|
||||
ldconfig /opt/Python3.7.13
|
||||
echo "Python-3.7.13...OK"
|
||||
else
|
||||
echo "Python-3.7.13 already installed!"
|
||||
fi
|
||||
|
||||
if ! id -u odoo &>/dev/null; then
|
||||
echo "creating system user <odoo>"
|
||||
useradd -rms /bin/bash odoo
|
||||
else
|
||||
echo "user <odoo> already exists!"
|
||||
fi
|
||||
|
||||
cat <<EOT | su - odoo
|
||||
if [[ ! -d odoo12 ]]; then
|
||||
echo "git odoo12 from remote"
|
||||
git clone https://github.com/odoo/odoo.git --depth 1 --branch 12.0 odoo12
|
||||
else
|
||||
echo "git odoo12 already downloaded!"
|
||||
fi
|
||||
if [[ ! -d venv ]]; then
|
||||
echo "installing Python-3.7 virtual env (venv)"
|
||||
python3.7 -m venv venv
|
||||
source venv/bin/activate
|
||||
python -m pip install --upgrade pip
|
||||
pip install wheel
|
||||
pip install -r odoo12/requirements.txt
|
||||
else
|
||||
echo "venv (Python-3.7) already installed!"
|
||||
fi
|
||||
|
||||
echo "community-color change to $BACKGROUND_COLOR"
|
||||
/opt/debian-bash/tools/append_or_replace "^.*o-community-color:.*" "\\\\\\\$o-community-color: $BACKGROUND_COLOR;" /home/odoo/odoo12/addons/web/static/src/scss/primary_variables.scss
|
||||
|
||||
EOT
|
||||
mkdir -p /etc/odoo12
|
||||
EOF
|
||||
|
||||
lxc file push "$MIAOU_BASEDIR/templates/apps/odoo12/odoo12-addon-install" "$CONTAINER/home/odoo/odoo12/odoo12-addon-install"
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
chown odoo:odoo /home/odoo/odoo12/odoo12-addon-install
|
||||
chmod 740 /home/odoo/odoo12/odoo12-addon-install
|
||||
echo "new script <odoo12-addon-install> added!"
|
||||
EOF
|
||||
|
||||
echo "push various target-related favicons..."
|
||||
for favicon in "$MIAOU_BASEDIR"/templates/apps/odoo12/favicon/*.ico; do
|
||||
lxc file push --uid 0 --gid 0 "$favicon" "$CONTAINER/home/odoo/odoo12/addons/web/static/src/img/"
|
||||
done
|
||||
echo "OK"
|
||||
|
||||
echo "adjust symbolic link according to target=<$TARGET>"
|
||||
lxc exec "$CONTAINER" -- rm -f /home/odoo/odoo12/addons/web/static/src/img/favicon.ico
|
||||
lxc exec "$CONTAINER" -- ln -s /home/odoo/odoo12/addons/web/static/src/img/favicon-"$TARGET".ico /home/odoo/odoo12/addons/web/static/src/img/favicon.ico
|
||||
echo "OK"
|
||||
}
|
||||
|
||||
function compute_bgcolor_target() {
|
||||
case "$TARGET" in
|
||||
dev) echo "#17a2b8" ;;
|
||||
beta) echo "#79A70A" ;;
|
||||
prod) echo "#7C7BAD" ;;
|
||||
*) echoerr "unknown target <$TARGET>" && exit 10 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
TARGET=$(yq '.target' "$EXPANDED_CONF")
|
||||
readonly TARGET
|
||||
BACKGROUND_COLOR=$(compute_bgcolor_target)
|
||||
readonly BACKGROUND_COLOR
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+196
@@ -0,0 +1,196 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_database_exists() {
|
||||
db-psql list | grep -q "$longname"
|
||||
}
|
||||
|
||||
function check_port_used() {
|
||||
# shellcheck disable=SC2034
|
||||
usedport=$(lxc exec "$container" -- bash -c "grep xmlrpc_port /etc/odoo15/$shortname.conf | cut -d' ' -f3")
|
||||
[[ "$usedport" == "$port" ]]
|
||||
}
|
||||
|
||||
function check_service_running() {
|
||||
lxc exec "$container" -- bash -c "systemctl is-active --quiet ${longname}.service"
|
||||
}
|
||||
|
||||
function _read() {
|
||||
disable_trace
|
||||
check_database_exists
|
||||
check_container "$container"
|
||||
check_port_used
|
||||
check_service_running
|
||||
enable_trace
|
||||
return 0
|
||||
}
|
||||
|
||||
function _create() {
|
||||
|
||||
echo "creating templates ... "
|
||||
mkdir -p "$MIAOU_CONFIGDIR/apps/odoo15"
|
||||
|
||||
longport=$((port + 1000))
|
||||
APP_PORT=$port LONG_PORT=$longport APP_NAME=$shortname tera -e -t "$MIAOU_DIR/templates/apps/odoo15/odoo.conf.j2" -o "$MIAOU_CONFIGDIR/apps/odoo15/$shortname.conf" "$MIAOU_CONFIGDIR/miaou.expanded.yaml" >/dev/null
|
||||
APP_NAME=$shortname tera -t "$MIAOU_DIR/templates/apps/odoo15/odoo.service.j2" --env-only -o "$MIAOU_CONFIGDIR/apps/odoo15/$longname.service" >/dev/null
|
||||
echo "creating templates ... OK"
|
||||
|
||||
echo "copying files over container <$container> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/odoo15/$shortname.conf" "$container/etc/odoo15/$shortname.conf"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/odoo15/$longname.service" "$container/etc/systemd/system/$longname.service"
|
||||
echo "copying files over container <$container> ... OK"
|
||||
|
||||
echo "create data folder for $shortname"
|
||||
cat <<EOF | lxc_exec "$container"
|
||||
set -Eeuo pipefail
|
||||
|
||||
echo allow addons writable for user odoo
|
||||
mkdir -p /home/odoo/data-$shortname/addons/15.0
|
||||
chmod u+w /home/odoo/data-$shortname/addons/15.0
|
||||
chown -R odoo:odoo /home/odoo/data-$shortname
|
||||
EOF
|
||||
|
||||
if ! (db-psql list | grep -q "$longname"); then
|
||||
echo "create empty database <$longname> ... "
|
||||
db-psql create "$longname"
|
||||
echo "create empty database <$longname> ... OK"
|
||||
|
||||
credential_username=$(load_yaml_from_expanded credential.username)
|
||||
credential_password=$(load_yaml_from_expanded credential.password)
|
||||
|
||||
cat <<EOF | lxc_exec "$container"
|
||||
set -Eeuo pipefail
|
||||
|
||||
echo reloading systemd
|
||||
systemctl daemon-reload
|
||||
systemctl stop $longname
|
||||
|
||||
echo initialize database...
|
||||
su odoo -c "python3.9 /home/odoo/odoo15/odoo-bin -c /etc/odoo15/$shortname.conf -i base --without-demo=all --stop-after-init"
|
||||
echo initialize database OK
|
||||
|
||||
echo install default modules ...
|
||||
su odoo -c "python3.9 /home/odoo/odoo15/odoo-bin -c /etc/odoo15/$shortname.conf -i account,contacts,l10n_fr,account,sale,point_of_sale -d $longname --worker=0 --stop-after-init"
|
||||
echo default modules OK
|
||||
|
||||
echo activate french language
|
||||
su odoo -c "python3.9 /home/odoo/odoo15/odoo-bin -c /etc/odoo15/$shortname.conf --load-language fr_FR -d $longname --worker=0 --stop-after-init"
|
||||
|
||||
echo change administrator password, default credential applied!
|
||||
echo "UPDATE res_users SET login='$credential_username', password='$credential_password' WHERE id=2" | PGPASSWORD=$longname psql -U $longname -h ct1.lxd
|
||||
|
||||
EOF
|
||||
else
|
||||
echo "database already exists!"
|
||||
fi
|
||||
|
||||
echo "initialize odoo $shortname $longname ..."
|
||||
cat <<EOF | lxc_exec "$container"
|
||||
set -Eeuo pipefail
|
||||
|
||||
echo reloading systemd
|
||||
systemctl daemon-reload
|
||||
|
||||
if ! systemctl is-active --quiet $longname; then
|
||||
echo start service $longname
|
||||
systemctl enable $longname
|
||||
systemctl start $longname
|
||||
systemctl is-active --quiet $longname
|
||||
else
|
||||
echo service $longname already started!
|
||||
fi
|
||||
|
||||
EOF
|
||||
echo "initialize odoo $shortname $longname ... OK"
|
||||
}
|
||||
|
||||
function _update() {
|
||||
echo "update"
|
||||
}
|
||||
|
||||
function _delete() {
|
||||
echo "delete"
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo "Usage: $COMMAND_NAME -c|r|u|d --port PORT --container CONTAINER --name NAME"
|
||||
exit 2
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
# init_strict
|
||||
|
||||
COMMAND_NAME=$(basename "$0")
|
||||
|
||||
# read the options
|
||||
|
||||
TEMP=$(getopt -n "$COMMAND_NAME" -o crud --long port:,container:,name:,fqdn: -- "$@")
|
||||
# shellcheck disable=SC2181
|
||||
[[ "$?" -eq 0 ]] || usage
|
||||
eval set -- "$TEMP"
|
||||
|
||||
action="unset"
|
||||
port="unset"
|
||||
container="unset"
|
||||
shortname="unset"
|
||||
longname="unset"
|
||||
|
||||
# extract options and their arguments into variables.
|
||||
while true; do
|
||||
case "$1" in
|
||||
--port)
|
||||
port=$2
|
||||
shift 2
|
||||
;;
|
||||
--fqdn)
|
||||
shift 2
|
||||
;;
|
||||
--container)
|
||||
container=$2
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
shortname=$2
|
||||
longname="odoo15-$shortname"
|
||||
shift 2
|
||||
;;
|
||||
-c)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_create"
|
||||
shift 1
|
||||
;;
|
||||
-r)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_read"
|
||||
shift 1
|
||||
;;
|
||||
-u)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_update"
|
||||
shift 1
|
||||
;;
|
||||
-d)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_delete"
|
||||
shift 1
|
||||
;;
|
||||
--)
|
||||
shift
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Internal error!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[[
|
||||
"$action" != unset &&
|
||||
"$port" != unset &&
|
||||
"$container" != unset &&
|
||||
"$shortname" != unset ]] || usage
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
$action
|
||||
Executable
+129
@@ -0,0 +1,129 @@
|
||||
#!/bin/bash
|
||||
|
||||
readonly EXPANDED_CONF="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
readonly ODOO15_DIR="/home/odoo/odoo15"
|
||||
|
||||
readonly WKHTML_VERSION="0.12.6.1-3"
|
||||
readonly WKHTML_RELEASE="$WKHTML_VERSION.bookworm_amd64"
|
||||
|
||||
function check_user_odoo() {
|
||||
(lxc exec "$CONTAINER" -- id odoo &>/dev/null) || return 12
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_target_bgcolor() {
|
||||
(lxc exec "$CONTAINER" -- grep -Pq "^\\\$o-community-color: $BACKGROUND_COLOR" "$ODOO15_DIR/addons/web/static/src/legacy/scss/primary_variables.scss") || return 13
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_file_odoo-addon-install() {
|
||||
(lxc exec "$CONTAINER" -- test -f /home/odoo/odoo15/odoo-addon-install) || return 23
|
||||
return 0
|
||||
}
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:odoo15:check"
|
||||
check_user_odoo || return 21
|
||||
check_target_bgcolor || return 22
|
||||
check_file_odoo-addon-install || return 23
|
||||
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:odoo15:install"
|
||||
: $PREFIX
|
||||
launch_container "$CONTAINER"
|
||||
echo "initializing Odoo15 ... "
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
cloud-init status --wait > /dev/null
|
||||
|
||||
echo "installing odoo15..."
|
||||
apt update && apt dist-upgrade -y
|
||||
|
||||
echo "required packages"
|
||||
apt install -y postgresql-client build-essential zlib1g-dev libssl-dev libxml2-dev libxslt1-dev libldap2-dev libsasl2-dev libpq-dev libffi-dev
|
||||
|
||||
if [[ ! -d /usr/local/share/python3.9 ]]; then
|
||||
echo "install python-3.9.18"
|
||||
cd /tmp
|
||||
wget https://www.python.org/ftp/python/3.9.18/Python-3.9.18.tgz
|
||||
tar -xf Python-3.9.18.tgz
|
||||
mv Python-3.9.18 /usr/local/share/python3.9
|
||||
cd /usr/local/share/python3.9
|
||||
./configure --enable-optimizations --enable-shared
|
||||
make -j \$(nproc)
|
||||
make altinstall
|
||||
ldconfig /usr/local/share/python3.9
|
||||
else
|
||||
echo "python-3.9.18 already installed!"
|
||||
fi
|
||||
|
||||
if dpkg -l | grep -s wkhtmltox | grep -qs $WKHTML_VERSION; then
|
||||
echo package=wkhtmltox version=$WKHTML_RELEASE already found!
|
||||
else
|
||||
echo "wkhtmltox version=$WKHTML_RELEASE has to be installed!"
|
||||
wget https://github.com/wkhtmltopdf/packaging/releases/download/$WKHTML_VERSION/wkhtmltox_$WKHTML_RELEASE.deb
|
||||
dpkg -i wkhtmltox_$WKHTML_RELEASE.deb || (apt -fy install && rm wkhtmltox_$WKHTML_RELEASE.deb)
|
||||
fi
|
||||
|
||||
if ! grep -q odoo /etc/passwd; then
|
||||
echo "add user <odoo>"
|
||||
useradd -ms /bin/bash odoo
|
||||
else
|
||||
echo "user <odoo> already set!"
|
||||
fi
|
||||
|
||||
echo "install odoo15 in odoo userspace"
|
||||
cat <<EOT | su - odoo
|
||||
set -Eeuo pipefail
|
||||
|
||||
if [[ ! -d odoo15 ]]; then
|
||||
echo "git odoo15 from remote"
|
||||
git clone https://github.com/odoo/odoo.git --depth 1 --branch 15.0 odoo15
|
||||
export MAKEFLAGS="-j\$(nproc)"
|
||||
pip3.9 install --upgrade pip
|
||||
pip3.9 install wheel pypdf2 slugify
|
||||
pip3.9 install -r odoo15/requirements.txt
|
||||
else
|
||||
echo "git odoo15 already downloaded!"
|
||||
fi
|
||||
echo "community-color change to $BACKGROUND_COLOR"
|
||||
/opt/debian-bash/tools/append_or_replace "^.*o-community-color:.*" "\\\\\\\$o-community-color: $BACKGROUND_COLOR !default;" /home/odoo/odoo15/addons/web/static/src/legacy/scss/primary_variables.scss
|
||||
|
||||
EOT
|
||||
mkdir -p /etc/odoo15
|
||||
EOF
|
||||
lxc file push "$MIAOU_BASEDIR/templates/apps/odoo15/odoo-addon-install" "$CONTAINER/home/odoo/odoo15/odoo-addon-install"
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
chown odoo:odoo /home/odoo/odoo15/odoo-addon-install
|
||||
chmod 740 /home/odoo/odoo15/odoo-addon-install
|
||||
echo "new script <odoo-addon-install> added!"
|
||||
EOF
|
||||
}
|
||||
|
||||
function compute_bgcolor_target() {
|
||||
target=$(yq '.target' "$EXPANDED_CONF")
|
||||
case "$target" in
|
||||
dev) builtin echo "#17a2b8" ;;
|
||||
beta) builtin echo "#79A70A" ;;
|
||||
prod) builtin echo "#7C7BAD" ;;
|
||||
*) echoerr "unknown target <$target>" && exit 10 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
BACKGROUND_COLOR=$(compute_bgcolor_target)
|
||||
readonly BACKGROUND_COLOR
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+68
@@ -0,0 +1,68 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:postgresql:check"
|
||||
container_running "$CONTAINER" || return 10
|
||||
echo "checking postgresql regarding access to the bridge subnet <$BRIDGE_SUBNET>..."
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
systemctl is-active postgresql.service &>/dev/null
|
||||
ss -tlnp | grep postgres | grep -q 0.0.0.0:5432
|
||||
PG_VERSION=\$(pg_lsclusters -h | cut -d' ' -f1)
|
||||
grep -Eq "^host.*all.*all.*$BRIDGE_SUBNET.*md5" /etc/postgresql/\$PG_VERSION/main/pg_hba.conf
|
||||
test -f /etc/default/autopostgresqlbackup
|
||||
EOF
|
||||
status="$?"
|
||||
[[ $status -eq 0 ]] && echo "container <$CONTAINER> approved!"
|
||||
return $status
|
||||
}
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:postgresql:install"
|
||||
: "$PREFIX"
|
||||
|
||||
echowarn "initializing postgresql regarding access to the bridge subnet <$BRIDGE_SUBNET>..."
|
||||
|
||||
launch_container "$CONTAINER"
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
|
||||
apt update
|
||||
. /opt/debian-bash/lib/functions.sh
|
||||
/opt/debian-bash/tools/idem_apt_install postgresql
|
||||
|
||||
echo -n "start postgresql now..."
|
||||
PG_VERSION=\$(pg_lsclusters -h | cut -d' ' -f1)
|
||||
pg_ctlcluster \$PG_VERSION main start
|
||||
echo "OK"
|
||||
|
||||
function systemctl-exists() ([ \$(systemctl list-unit-files "\${1}*" | wc -l) -gt 3 ])
|
||||
systemctl-exists exim4.service && systemctl disable exim4.service
|
||||
|
||||
/opt/debian-bash/tools/append_or_replace "^listen_addresses = .*$" "listen_addresses = '0.0.0.0'" /etc/postgresql/\$PG_VERSION/main/postgresql.conf
|
||||
/opt/debian-bash/tools/append_or_replace "^host.*all.*all.*$BRIDGE_SUBNET.*md5" "host\tall\t\tall\t\t$BRIDGE_SUBNET\t\tmd5" /etc/postgresql/\$PG_VERSION/main/pg_hba.conf
|
||||
systemctl restart postgresql.service
|
||||
EOF
|
||||
|
||||
echo -n "copying <autopostgresqlbackup> files over container <$CONTAINER> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/autopostgresqlbackup/script" "$CONTAINER/usr/sbin/autopostgresqlbackup"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/autopostgresqlbackup/cron.daily" "$CONTAINER/etc/cron.daily/autopostgresqlbackup"
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/autopostgresqlbackup/default.conf" "$CONTAINER/etc/default/autopostgresqlbackup"
|
||||
PREFIX="" echo OK
|
||||
|
||||
}
|
||||
|
||||
# MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
|
||||
CONTAINER="$1"
|
||||
BRIDGE_SUBNET=$(lxc network get lxdbr0 ipv4.address)
|
||||
readonly CONTAINER BRIDGE_SUBNET
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+202
@@ -0,0 +1,202 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_database_exists() {
|
||||
db-maria list | grep -q "$longname"
|
||||
}
|
||||
|
||||
function check_port_used() {
|
||||
# shellcheck disable=SC2034
|
||||
usedport=$(lxc exec "$container" -- bash -c "grep listen /etc/nginx/sites-enabled/$longname.conf | cut -d' ' -f6")
|
||||
[[ "$usedport" == "$port" ]]
|
||||
}
|
||||
|
||||
function check_service_running() {
|
||||
lxc exec "$container" -- bash -c "systemctl is-active --quiet nginx.service"
|
||||
}
|
||||
|
||||
function _read() {
|
||||
disable_trace
|
||||
check_database_exists
|
||||
check_container "$container"
|
||||
check_port_used
|
||||
check_service_running
|
||||
enable_trace
|
||||
return 0
|
||||
}
|
||||
|
||||
function _create() {
|
||||
|
||||
echo "creating wordpress instance for <$shortname> ... "
|
||||
|
||||
mkdir -p "$MIAOU_CONFIGDIR/apps/wordpress"
|
||||
APP_PORT=$port APP_NAME=$shortname tera -e --env-key env -t "$MIAOU_BASEDIR/templates/apps/wordpress/wp-host.j2" -o "$MIAOU_CONFIGDIR/apps/wordpress/$longname.conf" "$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
echo "creating templates ... OK"
|
||||
|
||||
echo "copying files over container <$container> ... "
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_CONFIGDIR/apps/wordpress/$longname.conf" "$container/etc/nginx/sites-available/$longname.conf"
|
||||
echo "copying files over container <$container> ... OK"
|
||||
|
||||
if ! (db-maria list | grep -q "$longname"); then
|
||||
echo "create empty database <$longname> ... "
|
||||
db-maria create "$longname"
|
||||
echo "create empty database <$longname> ... OK"
|
||||
else
|
||||
echo "database already exists!"
|
||||
fi
|
||||
|
||||
echo "initialize wordpress $shortname $longname ..."
|
||||
lxc exec "$container" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
if [[ ! -d /var/www/wordpress/$shortname ]]; then
|
||||
echo "installing new instance of wordpress into /var/www/wordpress/$shortname"
|
||||
mkdir -p /tmp/$shortname
|
||||
tar -xzf /var/www/wordpress-latest.tgz -C /tmp/$shortname
|
||||
mv /tmp/$shortname/wordpress /var/www/wordpress/$shortname
|
||||
else
|
||||
echo "instance of wordpress /var/www/wordpress/$shortname already defined!"
|
||||
fi
|
||||
|
||||
if [[ ! -f /var/www/wordpress/$shortname/wp-config.php ]]; then
|
||||
echo "create wp-config.php"
|
||||
cat << 'EOT2' > /var/www/wordpress/$shortname/wp-config.php
|
||||
<?php
|
||||
|
||||
define( 'DB_NAME', '$longname' );
|
||||
define( 'DB_USER', '$longname' );
|
||||
define( 'DB_PASSWORD', '$longname' );
|
||||
define( 'DB_HOST', 'ct1.lxd' );
|
||||
|
||||
define( 'DB_CHARSET', 'utf8' );
|
||||
define( 'DB_COLLATE', '' );
|
||||
|
||||
define( 'AUTH_KEY', '$(genpasswd 20)' );
|
||||
define( 'SECURE_AUTH_KEY', '$(genpasswd 20)' );
|
||||
define( 'LOGGED_IN_KEY', '$(genpasswd 20)' );
|
||||
define( 'NONCE_KEY', '$(genpasswd 20)' );
|
||||
define( 'AUTH_SALT', '$(genpasswd 20)' );
|
||||
define( 'SECURE_AUTH_SALT', '$(genpasswd 20)' );
|
||||
define( 'LOGGED_IN_SALT', '$(genpasswd 20)' );
|
||||
define( 'NONCE_SALT', '$(genpasswd 20)' );
|
||||
|
||||
\$table_prefix = 'wp_';
|
||||
define( 'WP_DEBUG', false );
|
||||
|
||||
/* Add any custom values between this line and the "stop editing" line. */
|
||||
\$_SERVER['HTTPS'] = 'on';
|
||||
|
||||
/* That's all, stop editing! Happy publishing. */
|
||||
|
||||
/** Absolute path to the WordPress directory. */
|
||||
if ( ! defined( 'ABSPATH' ) ) {
|
||||
define( 'ABSPATH', __DIR__ . '/' );
|
||||
}
|
||||
|
||||
/** Sets up WordPress vars and included files. */
|
||||
require_once ABSPATH . 'wp-settings.php';
|
||||
EOT2
|
||||
|
||||
else
|
||||
echo "wp-config.php already defined!"
|
||||
fi
|
||||
|
||||
chown -R www-data:www-data /var/www/wordpress/$shortname
|
||||
|
||||
echo "enabling wordpress host into nginx"
|
||||
mkdir -p /var/log/nginx/$shortname
|
||||
ln -sf "/etc/nginx/sites-available/$longname.conf" "/etc/nginx/sites-enabled/$longname.conf"
|
||||
|
||||
echo "reloading nginx"
|
||||
nginx -tq && systemctl reload nginx
|
||||
EOF
|
||||
echo "initialize wordpress $shortname $longname ... OK"
|
||||
}
|
||||
|
||||
function _update() {
|
||||
echo "update"
|
||||
}
|
||||
|
||||
function _delete() {
|
||||
echo "delete"
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo "Usage: $COMMAND_NAME -c|r|u|d --port PORT --container CONTAINER --name NAME"
|
||||
exit 2
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
# init_strict
|
||||
|
||||
COMMAND_NAME=$(basename "$0")
|
||||
|
||||
# read the options
|
||||
|
||||
TEMP=$(getopt -n "$COMMAND_NAME" -o crud --long port:,container:,name:,fqdn: -- "$@")
|
||||
# shellcheck disable=SC2181
|
||||
[[ "$?" -eq 0 ]] || usage
|
||||
eval set -- "$TEMP"
|
||||
|
||||
action="unset"
|
||||
port="unset"
|
||||
container="unset"
|
||||
shortname="unset"
|
||||
longname="unset"
|
||||
|
||||
# extract options and their arguments into variables.
|
||||
while true; do
|
||||
case "$1" in
|
||||
--port)
|
||||
port=$2
|
||||
shift 2
|
||||
;;
|
||||
--fqdn)
|
||||
shift 2
|
||||
;;
|
||||
--container)
|
||||
container=$2
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
shortname=$2
|
||||
longname="wp-$shortname"
|
||||
shift 2
|
||||
;;
|
||||
-c)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_create"
|
||||
shift 1
|
||||
;;
|
||||
-r)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_read"
|
||||
shift 1
|
||||
;;
|
||||
-u)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_update"
|
||||
shift 1
|
||||
;;
|
||||
-d)
|
||||
[[ "$action" == "unset" ]] || usage
|
||||
action="_delete"
|
||||
shift 1
|
||||
;;
|
||||
--)
|
||||
shift
|
||||
break
|
||||
;;
|
||||
*)
|
||||
echo "Internal error!"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
[[
|
||||
"$action" != unset &&
|
||||
"$port" != unset &&
|
||||
"$container" != unset &&
|
||||
"$shortname" != unset ]] || usage
|
||||
$action
|
||||
Executable
+83
@@ -0,0 +1,83 @@
|
||||
#!/bin/bash
|
||||
|
||||
MANDATORY_PACKAGES_STRING="nginx php-cli php-fpm php-mysql php-curl php-xml php-imagick php-zip php-gd php-intl composer mariadb-client"
|
||||
|
||||
### CHECK
|
||||
|
||||
function check() {
|
||||
PREFIX="recipe:wordpress:check"
|
||||
check_mandatory_packages || return 21
|
||||
check_wordpress_tgz || return 22
|
||||
check_wp-tool || return 23
|
||||
check_wp-backup || return 24
|
||||
|
||||
echo "container <$CONTAINER> approved successfully!"
|
||||
return 0
|
||||
}
|
||||
|
||||
function check_mandatory_packages() {
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
mapfile -t PACKAGES <<< "$MANDATORY_PACKAGES_STRING"
|
||||
for package in \${PACKAGES[@]}; do
|
||||
dpkg -l "\$package" 2>/dev/null | grep -q ^ii
|
||||
done
|
||||
EOF
|
||||
}
|
||||
|
||||
function check_wp-tool() {
|
||||
lxc exec "$CONTAINER" -- test -f /usr/local/sbin/wp-tool
|
||||
}
|
||||
|
||||
function check_wp-backup() {
|
||||
lxc exec "$CONTAINER" -- test -f /usr/local/sbin/wp-backup
|
||||
}
|
||||
|
||||
function check_wordpress_tgz() {
|
||||
lxc exec "$CONTAINER" -- test -f /var/www/wordpress-latest.tgz
|
||||
}
|
||||
|
||||
### INSTALL
|
||||
|
||||
function install() {
|
||||
PREFIX="recipe:wordpress:install"
|
||||
: $PREFIX
|
||||
launch_container "$CONTAINER"
|
||||
echo "initializing Wordpress ... "
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
echo installing wordpress...
|
||||
apt-get install -y $MANDATORY_PACKAGES_STRING
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
rm -f /etc/nginx/sites-available/default
|
||||
systemctl reload nginx
|
||||
|
||||
/TOOLBOX/wget https://wordpress.org/latest.tar.gz -O /var/www/wordpress-latest.tgz
|
||||
mkdir -p /var/www/wordpress
|
||||
chown www-data:www-data /var/www/wordpress
|
||||
EOF
|
||||
echo "OK"
|
||||
|
||||
echo -n "copying wp-tool to /usr/local/sbin/..."
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/wordpress/wp-tool" "$CONTAINER/usr/local/sbin/wp-tool"
|
||||
lxc exec "$CONTAINER" -- chmod +x /usr/local/sbin/wp-tool
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
echo -n "copying wp-backup to /usr/local/sbin/..."
|
||||
lxc file push --uid 0 --gid 0 "$MIAOU_BASEDIR/templates/apps/wordpress/wp-backup" "$CONTAINER/usr/local/sbin/wp-backup"
|
||||
lxc exec "$CONTAINER" -- chmod +x /usr/local/sbin/wp-backup
|
||||
PREFIX="" echo "OK"
|
||||
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER="$1"
|
||||
|
||||
check || (
|
||||
install
|
||||
check
|
||||
)
|
||||
Executable
+221
@@ -0,0 +1,221 @@
|
||||
#!/bin/bash
|
||||
|
||||
DEFAULT_BACKUP_FOLDER="$HOME/RECOVERY_MARIADB"
|
||||
|
||||
confirm() {
|
||||
read -rp "$1 ([y]es or [N]o): "
|
||||
case $(echo "$REPLY" | tr '[:upper:]' '[:lower:]') in
|
||||
y | yes) echo "yes" ;;
|
||||
*) echo "no" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
synopsis() {
|
||||
echo "usage: "
|
||||
printf "\t list | console | connections\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t use <DB_NAME>\n"
|
||||
printf "\t create <DB_NAME> [PASSWORD]\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t backup <DB_NAME> [FOLDER]\n"
|
||||
printf "\t restore <DB_NAME> <FILE>\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t rename <DB_NAME> <NEW_NAME>\n"
|
||||
}
|
||||
|
||||
list() {
|
||||
lxc exec ct1 -- sh -c "echo \"SELECT schema_name FROM information_schema.schemata where schema_name not in ('information_schema','mariadb','mysql','performance_schema')\" | mariadb -u root --skip-column-names -r "
|
||||
}
|
||||
|
||||
console() {
|
||||
if [[ -z $1 ]]; then
|
||||
lxc exec ct1 -- mariadb -u root
|
||||
else
|
||||
lxc exec ct1 -- sh -c "echo \"$1\" | mariadb -u root"
|
||||
fi
|
||||
}
|
||||
|
||||
connections() {
|
||||
lxc exec ct1 -- sh -c "echo \"select id, user, host, db, command, time, state, info, progress from information_schema.processlist\" | mariadb -u root "
|
||||
}
|
||||
|
||||
use() {
|
||||
lxc exec ct1 -- mariadb -u root "$DB_NAME"
|
||||
}
|
||||
|
||||
create() {
|
||||
|
||||
# shellcheck disable=SC1091
|
||||
source /opt/debian-bash/lib/functions.sh
|
||||
|
||||
# shellcheck disable=SC2034
|
||||
mapfile -t DBs < <(list)
|
||||
|
||||
local NEW_DB="${1:-$DB_NAME}"
|
||||
local NEW_PASSWORD="${2:-$NEW_DB}"
|
||||
|
||||
if ! containsElement DBs "$NEW_DB"; then
|
||||
lxc exec ct1 -- sh -c "echo \"\
|
||||
CREATE DATABASE \\\`$NEW_DB\\\`; \
|
||||
GRANT ALL ON \\\`$NEW_DB\\\`.* TO \\\`$NEW_DB\\\`@'%' IDENTIFIED BY '$NEW_PASSWORD'; \
|
||||
FLUSH PRIVILEGES; \
|
||||
\" | mariadb -u root"
|
||||
else
|
||||
echo "$NEW_DB already exists!"
|
||||
fi
|
||||
}
|
||||
|
||||
backup() {
|
||||
|
||||
if [[ ! -d "$FOLDER" ]]; then
|
||||
echo "error: Folder required!"
|
||||
file "$FOLDER"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
mkdir -p "$FOLDER"
|
||||
DATE=$(date '+%F')
|
||||
ARCHIVE="$FOLDER"/$DB_NAME-$DATE.mariadb.gz
|
||||
|
||||
if [[ -f $ARCHIVE ]]; then
|
||||
VERSION_CONTROL=numbered mv -b "$ARCHIVE" "$FOLDER"/"$DB_NAME"-"$DATE"-daily.mariadb.gz
|
||||
fi
|
||||
|
||||
echo "backup $DB_NAME into $FOLDER"
|
||||
mariadb-dump -h ct1.lxd -u "$DB_NAME" -p"$DB_NAME" "$DB_NAME" | gzip >"$ARCHIVE"
|
||||
echo "archive file created: $ARCHIVE"
|
||||
}
|
||||
|
||||
restore() {
|
||||
|
||||
echo "restore $DB_NAME $FILE"
|
||||
if [[ ! -f "$FILE" ]]; then
|
||||
echo "error: Backup file (*.mariadb.gz) required!"
|
||||
file "$FILE"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
PROCESSES=$(lxc exec ct1 -- sh -c "echo \"select id, user, host, db, command, time, state, info, progress from information_schema.processlist\" | mariadb -u root")
|
||||
|
||||
set +e
|
||||
PROCESS_COUNT=$(echo "$PROCESSES" | grep -c "$DB_NAME")
|
||||
if [[ $PROCESS_COUNT -gt 0 ]]; then
|
||||
echo "FAILURE: There are some connections to database, please consider stopping bound services"
|
||||
echo
|
||||
echo "$PROCESSES"
|
||||
exit 2
|
||||
fi
|
||||
set -e
|
||||
|
||||
if [[ "yes" == $(confirm "RESTORATION will drop DATABASE, please acknowledge with care!!!") ]]; then
|
||||
if list | grep -q "$DB_NAME"; then
|
||||
echo "backup <$DB_NAME> for safety reason"
|
||||
backup
|
||||
echo "drop database <$DB_NAME>"
|
||||
lxc exec ct1 -- sh -c "echo \"DROP DATABASE \\\`$DB_NAME\\\`\" | mariadb -u root"
|
||||
fi
|
||||
|
||||
echo "create <$DB_NAME>"
|
||||
create
|
||||
# lxc exec ct1 -- sh -c "CREATE DATABASE \\\`$DB_NAME\\\`\" | mariadb -u root"
|
||||
gunzip -c "$FILE" | grep -av "^CREATE DATABASE" | grep -av "^USE" | mariadb -h ct1.lxd -u "$DB_NAME" -p"$DB_NAME" "$DB_NAME"
|
||||
echo RESTORATION completed successfully
|
||||
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
rename() {
|
||||
echo "rename $DB_NAME to $NEW_NAME"
|
||||
local DB_NAME_FOUND=false
|
||||
for database in $(list); do
|
||||
if [[ $database == "$DB_NAME" ]]; then
|
||||
DB_NAME_FOUND=true
|
||||
fi
|
||||
if [[ $database == "$NEW_NAME" ]]; then
|
||||
echoerr "$NEW_NAME already exists! please provide another name instead of <$NEW_NAME> or run list command"
|
||||
exit 20
|
||||
fi
|
||||
done
|
||||
if [[ ! $DB_NAME_FOUND ]]; then
|
||||
echoerr "source <$DB_NAME> does not exist!"
|
||||
exit 20
|
||||
fi
|
||||
|
||||
if [[ "$DB_NAME" == "$NEW_NAME" ]]; then
|
||||
echowarn "no need to rename; no change required <$DB_NAME>"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "create new database <$NEW_NAME>"
|
||||
create "$NEW_NAME"
|
||||
|
||||
for table in $(console "use '$DB_NAME'; show tables"); do
|
||||
if [[ $table != "Tables_in_$DB_NAME" ]]; then
|
||||
echo "renaming table \`$DB_NAME\`.$table to \`$NEW_NAME\`.$table"
|
||||
console "use '$DB_NAME'; rename table \\\`$DB_NAME\\\`.$table to \\\`$NEW_NAME\\\`.$table;"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "every table has been renamed, so remove old database <$DB_NAME>"
|
||||
console "drop user \\\`$DB_NAME\\\`"
|
||||
console "drop database \\\`$DB_NAME\\\`"
|
||||
}
|
||||
|
||||
# MAIN
|
||||
set -Eeuo pipefail
|
||||
# shellcheck source=/dev/null
|
||||
. "$MIAOU_BASEDIR/lib/functions.sh"
|
||||
|
||||
[[ $# -lt 1 ]] && synopsis && exit 1
|
||||
ACTION=$1
|
||||
|
||||
case $ACTION in
|
||||
console)
|
||||
shift
|
||||
TAIL=$*
|
||||
console "$TAIL"
|
||||
;;
|
||||
list)
|
||||
list
|
||||
;;
|
||||
connections)
|
||||
connections
|
||||
;;
|
||||
use)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
use
|
||||
;;
|
||||
create)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
DB_PASSWORD=${3:-$DB_NAME}
|
||||
create
|
||||
;;
|
||||
backup)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
FOLDER=${3:-$DEFAULT_BACKUP_FOLDER}
|
||||
backup
|
||||
;;
|
||||
restore)
|
||||
[[ $# -lt 3 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
FILE=$3
|
||||
FOLDER=${4:-$DEFAULT_BACKUP_FOLDER}
|
||||
DB_PASSWORD="$DB_NAME"
|
||||
restore
|
||||
;;
|
||||
rename)
|
||||
[[ $# -lt 3 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
NEW_NAME=$3
|
||||
rename
|
||||
;;
|
||||
*)
|
||||
synopsis
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Executable
+200
@@ -0,0 +1,200 @@
|
||||
#!/bin/bash
|
||||
|
||||
confirm() {
|
||||
read -p "$1 ([y]es or [N]o): "
|
||||
case $(echo $REPLY | tr '[A-Z]' '[a-z]') in
|
||||
y | yes) echo "yes" ;;
|
||||
*) echo "no" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
synopsis() {
|
||||
echo "usage: "
|
||||
printf "\t list | console | connections\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t use <DB_NAME>\n"
|
||||
printf "\t lookup <DB_NAME> <TERM>\n"
|
||||
printf "\t create <DB_NAME> [PASSWORD]\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t backup <DB_NAME> [FOLDER]\n"
|
||||
printf "\t restore <DB_NAME> <FILE> [--yes]\n"
|
||||
printf "\t ---------------------------\n"
|
||||
printf "\t rename <DB_NAME> <NEW_NAME>\n"
|
||||
}
|
||||
|
||||
list() {
|
||||
lxc exec ct1 -- su - postgres -c "psql -Atc \"SELECT datname FROM pg_database WHERE datistemplate=false AND datname<>'postgres';\""
|
||||
}
|
||||
|
||||
console() {
|
||||
if [[ -z $1 ]]; then
|
||||
lxc exec ct1 -- su - postgres
|
||||
else
|
||||
lxc exec ct1 -- su - postgres -c "$1"
|
||||
fi
|
||||
}
|
||||
|
||||
connections() {
|
||||
PROCESSES=$(console "psql -c \"select pid as process_id, usename as username, datname as database_name, client_addr as client_address, application_name, backend_start, state, state_change from pg_stat_activity WHERE datname<>'postgres' ORDER BY datname, usename;\"")
|
||||
printf "$PROCESSES\n"
|
||||
}
|
||||
|
||||
use() {
|
||||
echo >&2 "about to connect to <${DB_NAME}> ..."
|
||||
if [[ -z $1 ]]; then
|
||||
lxc exec ct1 -- su - postgres -c "psql $DB_NAME"
|
||||
else
|
||||
local sql="psql -A -t $DB_NAME -c \\\"$1;\\\""
|
||||
local command="su - postgres -c \"$sql\""
|
||||
lxc exec ct1 -- sh -c "$command"
|
||||
fi
|
||||
}
|
||||
|
||||
create() {
|
||||
echo >&2 "about to create to <${DB_NAME}> ..."
|
||||
source /opt/debian-bash/lib/functions.sh
|
||||
local DBs=($(list))
|
||||
if ! $(containsElement DBs $DB_NAME); then
|
||||
local SQL="CREATE USER \\\\\\\"$DB_NAME\\\\\\\" WITH PASSWORD '$DB_PASSWORD'"
|
||||
local command="su - postgres sh -c \"psql -c \\\"$SQL\\\"\" && su - postgres sh -c \"createdb -O $DB_NAME $DB_NAME\" && echo CREATE DB"
|
||||
# echo $command
|
||||
lxc exec ct1 -- sh -c "$command"
|
||||
else
|
||||
echo $DB_NAME already exists!
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
lookup() {
|
||||
if [[ ${#TERM} -ge 4 ]]; then
|
||||
echo >&2 "about to lookup term <${TERM}> over all tables of database <$DB_NAME> ..."
|
||||
local command="pg_dump --data-only --inserts $DB_NAME 2>/dev/null | grep --color \"$TERM\""
|
||||
lxc exec ct1 -- su - postgres -c "$command"
|
||||
else
|
||||
echo "term <$TERM> should contain 4 chars minimum!" && exit 2
|
||||
fi
|
||||
}
|
||||
|
||||
backup() {
|
||||
if [[ ! -d "$FOLDER" ]]; then
|
||||
echo "error: Folder required!"
|
||||
file $FOLDER
|
||||
exit 2
|
||||
fi
|
||||
DATE=$(date '+%F')
|
||||
ARCHIVE="$FOLDER"/$DB_NAME-$DATE.postgres.gz
|
||||
|
||||
if [[ -f $ARCHIVE ]]; then
|
||||
VERSION_CONTROL=numbered mv -b $ARCHIVE "$FOLDER"/$DB_NAME-$DATE-daily.postgres.gz
|
||||
fi
|
||||
|
||||
echo "backup $DB_NAME $FOLDER"
|
||||
PGPASSWORD=$DB_NAME pg_dump -U $DB_NAME $DB_NAME -h ct1.lxd | gzip >"$ARCHIVE"
|
||||
echo "archive file created: $ARCHIVE"
|
||||
}
|
||||
|
||||
restore() {
|
||||
echo "restore $DB_NAME $FILE"
|
||||
if [[ ! -f "$FILE" ]]; then
|
||||
echo "error: Backup file (*.postgres.gz) required!"
|
||||
file $FILE
|
||||
exit 2
|
||||
fi
|
||||
PROCESSES=$(console "psql -c \"select pid as process_id, usename as username, datname as database_name, client_addr as client_address, application_name, backend_start, state, state_change from pg_stat_activity WHERE datname='$DB_NAME';\"")
|
||||
PROCESS_COUNT=$(echo "$PROCESSES" | wc -l)
|
||||
if [[ $PROCESS_COUNT -gt 3 ]]; then
|
||||
echo "FAILURE: There are some connections to database, please consider stopping bound services"
|
||||
echo
|
||||
printf "$PROCESSES\n"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if [[ $YES == "true" || "yes" == $(confirm "RESTORATION will drop DATABASE, please acknowledge with care!!!") ]]; then
|
||||
FOLDER="$HOME/RECOVERY_POSTGRES"
|
||||
mkdir -p "$FOLDER"
|
||||
backup
|
||||
echo "backup successful, now drop and restore"
|
||||
lxc exec ct1 -- su - postgres -c "dropdb $DB_NAME && createdb -O $DB_NAME $DB_NAME"
|
||||
gunzip -c "$FILE" | grep -v "^CREATE DATABASE" | PGPASSWORD=$DB_NAME PGOPTIONS='--client-min-messages=warning' psql -X -q -1 -v ON_ERROR_STOP=1 --pset pager=off -U $DB_NAME -h ct1.lxd $DB_NAME 2>&1 >/dev/null
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
rename() {
|
||||
echo "rename <$DB_NAME> to <$DB_NEW_NAME>"
|
||||
mapfile -t LIST <<<"$(list)"
|
||||
found=false
|
||||
for db in "${LIST[@]}"; do
|
||||
[[ "$db" == "$DB_NEW_NAME" ]] && echoerr "destination database <$DB_NEW_NAME> already exists! Please provide another name." && exit 11
|
||||
[[ "$db" == "$DB_NAME" ]] && found=true
|
||||
done
|
||||
$found || (echoerr "source database <$DB_NAME> not found!" && exit 12)
|
||||
|
||||
console "psql -c \"ALTER DATABASE \\\"$DB_NAME\\\" RENAME TO \\\"$DB_NEW_NAME\\\" \""
|
||||
console "psql -c \"ALTER USER \\\"$DB_NAME\\\" RENAME TO \\\"$DB_NEW_NAME\\\" \""
|
||||
console "psql -c \"ALTER USER \\\"$DB_NEW_NAME\\\" PASSWORD '$DB_NEW_NAME' \""
|
||||
|
||||
}
|
||||
|
||||
# MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
[[ $# -lt 1 ]] && synopsis && exit 1
|
||||
ACTION=$1
|
||||
|
||||
case $ACTION in
|
||||
console)
|
||||
shift
|
||||
TAIL="$@"
|
||||
console "$TAIL"
|
||||
;;
|
||||
list)
|
||||
list
|
||||
;;
|
||||
connections)
|
||||
connections
|
||||
;;
|
||||
use)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
shift 2
|
||||
TAIL="$@"
|
||||
use "$TAIL"
|
||||
;;
|
||||
create)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
DB_PASSWORD=${3:-$DB_NAME}
|
||||
create
|
||||
;;
|
||||
lookup)
|
||||
[[ $# -lt 3 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
TERM=$3
|
||||
lookup
|
||||
;;
|
||||
backup)
|
||||
[[ $# -lt 2 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
FOLDER=${3:-.}
|
||||
backup
|
||||
;;
|
||||
restore)
|
||||
[[ $# -lt 3 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
FILE=$3
|
||||
YES=true
|
||||
restore
|
||||
;;
|
||||
rename)
|
||||
[[ $# -lt 3 ]] && synopsis && exit 1
|
||||
DB_NAME=$2
|
||||
DB_NEW_NAME=$3
|
||||
rename
|
||||
;;
|
||||
*)
|
||||
synopsis
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Executable
+180
@@ -0,0 +1,180 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_container_missing() {
|
||||
if container_exists "$CONTAINER"; then
|
||||
echoerr "$CONTAINER already created!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function usage() {
|
||||
echo 'USAGE with options:'
|
||||
echo -e "\t\tlxc-miaou-create <CONTAINER_NAME> -o sameuser[,nesting,ssh]"
|
||||
}
|
||||
|
||||
function check() {
|
||||
check_container_missing || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
function set_options() {
|
||||
declare -a options=("$@")
|
||||
length=${#options[@]}
|
||||
if [[ "$length" -ne 0 ]]; then
|
||||
if [[ "$length" -ne 2 ]]; then
|
||||
echoerr "unrecognized options: $@" && usage && exit 30
|
||||
else
|
||||
prefix="${options[0]}"
|
||||
option="${options[1]}"
|
||||
if [[ "$prefix" == '-o' ]]; then
|
||||
IFS=',' read -r -a options <<<"$option"
|
||||
for i in ${options[@]}; do
|
||||
case "$i" in
|
||||
sameuser) OPTION_SAMEUSER=true ;;
|
||||
nesting) OPTION_NESTING=true ;;
|
||||
ssh) OPTION_SSH=true ;;
|
||||
*) echoerr "unrecognized options: $@" && usage && exit 32 ;;
|
||||
esac
|
||||
done
|
||||
# echo "OPTION_SAMEUSER=$OPTION_SAMEUSER, OPTION_NESTING=$OPTION_NESTING, OPTION_SSH=$OPTION_SSH"
|
||||
else
|
||||
echoerr "unrecognized options prefix: $prefix" && usage && exit 31
|
||||
fi
|
||||
fi
|
||||
shift
|
||||
fi
|
||||
}
|
||||
|
||||
function create() {
|
||||
local PREFIX="miaou:create"
|
||||
|
||||
if [[ "$OPTION_SAMEUSER" == true ]]; then
|
||||
miaou_user=$(whoami)
|
||||
fi
|
||||
|
||||
echo -n "creating new container <$CONTAINER> based on image <$CONTAINER_RELEASE>... "
|
||||
bridge_gw=$(lxc network get lxdbr0 ipv4.address | cut -d'/' -f1)
|
||||
user_data="$(
|
||||
cat <<EOF
|
||||
#cloud-config
|
||||
timezone: 'Indian/Reunion'
|
||||
apt:
|
||||
preserve_sources_list: false
|
||||
conf: |
|
||||
Acquire::Retries "60";
|
||||
DPkg::Lock::Timeout "60";
|
||||
primary:
|
||||
- arches: [default]
|
||||
uri: http://debian.mithril.re/debian
|
||||
security:
|
||||
- arches: [default]
|
||||
uri: http://debian.mithril.re/debian-security
|
||||
sources_list: |
|
||||
# generated by miaou-cloud
|
||||
deb \$PRIMARY \$RELEASE main
|
||||
deb \$PRIMARY \$RELEASE-updates main
|
||||
deb \$SECURITY \$RELEASE-security main
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
package_reboot_if_required: true
|
||||
packages:
|
||||
- git
|
||||
- file
|
||||
- bc
|
||||
- bash-completion
|
||||
write_files:
|
||||
- path: /etc/sudoers.d/10-add_TOOLBOX_to_secure_path
|
||||
content: >
|
||||
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/TOOLBOX"
|
||||
runcmd:
|
||||
- [ systemctl, mask, systemd-hostnamed.service ]
|
||||
- [ systemctl, disable, e2scrub_reap.service ]
|
||||
- [ systemctl, disable, systemd-resolved.service, --now ]
|
||||
- [ systemctl, reset-failed ]
|
||||
- [ rm, /etc/resolv.conf]
|
||||
- [ rm, /etc/sudoers.d/90-cloud-init-users]
|
||||
- "echo nameserver $bridge_gw > /etc/resolv.conf"
|
||||
final_message: "Container from datasource \$datasource is finally up, after \$UPTIME seconds"
|
||||
EOF
|
||||
)"
|
||||
lxc init images:debian/$CONTAINER_RELEASE/cloud "$CONTAINER" --config user.user-data="$user_data" -q
|
||||
|
||||
# allow directory `SHARED` to be read-write mounted
|
||||
lxc config set "$CONTAINER" raw.idmap "both $(id -u) 0" -q
|
||||
mkdir -p "$HOME/LXD/SHARED/$CONTAINER"
|
||||
|
||||
lxc config device add "$CONTAINER" SHARED disk source="$HOME/LXD/SHARED/$CONTAINER" path=/mnt/SHARED -q
|
||||
lxc config device add "$CONTAINER" TOOLBOX disk source=/TOOLBOX path=/TOOLBOX -q
|
||||
lxc config device add "$CONTAINER" DEBIAN_BASH disk source=$(realpath /opt/debian-bash) path=/opt/debian-bash -q
|
||||
lxc config set "$CONTAINER" environment.PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/debian-bash/tools:/TOOLBOX -q
|
||||
|
||||
if [[ "$OPTION_NESTING" == true ]]; then
|
||||
lxc config set $CONTAINER security.nesting true -q
|
||||
lxc config device add "$CONTAINER" miaou disk source=/opt/miaou path=/opt/miaou -q
|
||||
fi
|
||||
|
||||
lxc start "$CONTAINER" -q
|
||||
|
||||
# initializing debian-bash
|
||||
lxc exec "$CONTAINER" -- /opt/debian-bash/init.sh
|
||||
|
||||
# default configuration files (btm,)
|
||||
lxc exec "$CONTAINER" -- mkdir -p /root/.config/bottom
|
||||
lxc file push "$MIAOU_BASEDIR/templates/bottom/bottom.toml" "$CONTAINER/root/.config/bottom/bottom.toml" -q
|
||||
|
||||
# purge cloud-init after success
|
||||
lxc exec "$CONTAINER" -- systemd-run -q -p After=cloud-final.service -p Type=oneshot --no-block bash -c '\
|
||||
cloud-init status --wait &&\
|
||||
cp /var/lib/cloud/data/status.json /root/cloud-status.json &&\
|
||||
systemctl stop cloud-{config,final,init-local,init}.service &&\
|
||||
systemctl disable cloud-{config,final,init-local,init}.service &&\
|
||||
systemctl stop cloud-config.target cloud-init.target &&\
|
||||
apt-get purge -y cloud-init &&\
|
||||
rm -rf /var/lib/cloud && \
|
||||
userdel -rf debian \
|
||||
'
|
||||
|
||||
if [[ "$OPTION_SAMEUSER" == true ]]; then
|
||||
if ! lxc exec "$CONTAINER" -- grep "$miaou_user" /etc/passwd; then
|
||||
lxc exec "$CONTAINER" -- useradd -ms /bin/bash -G sudo "$miaou_user"
|
||||
fi
|
||||
if ! lxc exec "$CONTAINER" -- passwd -S "$miaou_user" | cut -d ' ' -f2 | grep -q ^P; then
|
||||
shadow_passwd=$(load_yaml_from_expanded credential.shadow)
|
||||
shadow_remainder=$(lxc exec "$CONTAINER" -- bash -c "grep $miaou_user /etc/shadow | cut -d':' -f3-")
|
||||
lxc exec "$CONTAINER" -- /opt/debian-bash/tools/append_or_replace "^$miaou_user:.*:" "$miaou_user:$shadow_passwd:$shadow_remainder" /etc/shadow >/dev/null
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$OPTION_SSH" == true ]]; then
|
||||
lxc exec "$CONTAINER" -- /opt/debian-bash/tools/idem_apt_install openssh-server
|
||||
fi
|
||||
|
||||
if [[ "$OPTION_SSH" == true && "$OPTION_SAMEUSER" == true ]]; then
|
||||
lxc-miaou-enable-ssh "$CONTAINER"
|
||||
fi
|
||||
|
||||
PREFIX="" echoinfo OK
|
||||
|
||||
echo "hint: \`lxc login $CONTAINER [--env user=<USER>]\`"
|
||||
[[ "$OPTION_SAMEUSER" == true ]] && echo "hint: \`lxc sameuser $CONTAINER\`"
|
||||
|
||||
true
|
||||
}
|
||||
|
||||
## MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
OPTION_SAMEUSER=false
|
||||
OPTION_NESTING=false
|
||||
OPTION_SSH=false
|
||||
PREFIX="miaou"
|
||||
|
||||
arg1_required "$@" || (usage && exit 1)
|
||||
readonly CONTAINER=$1
|
||||
readonly CONTAINER_RELEASE="bookworm"
|
||||
|
||||
shift
|
||||
set_options "$@"
|
||||
readonly FULL_OPTIONS="$@"
|
||||
|
||||
check
|
||||
create
|
||||
Executable
+88
@@ -0,0 +1,88 @@
|
||||
#!/bin/bash
|
||||
|
||||
function check_container_exists() {
|
||||
if ! container_exists "$CONTAINER"; then
|
||||
echoerr "container <$CONTAINER> does not exist!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
function check() {
|
||||
check_container_exists || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
function enable_ssh() {
|
||||
echo "lxc: enable ssh in container <$CONTAINER> for user <$SSH_USER>"
|
||||
|
||||
if ! container_running "$CONTAINER"; then
|
||||
echowarn "container <$CONTAINER> seems to be asleep, starting ..."
|
||||
lxc start "$CONTAINER"
|
||||
echowarn DONE
|
||||
fi
|
||||
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
if ! id "$SSH_USER" &>/dev/null; then
|
||||
echo "adding new user <$SSH_USER>"
|
||||
useradd -ms /bin/bash -G sudo "$SSH_USER"
|
||||
else
|
||||
echo "bash: $SSH_USER exists already!"
|
||||
fi
|
||||
EOF
|
||||
|
||||
miaou_user=$(whoami)
|
||||
shadow_passwd=$(load_yaml_from_expanded credential.shadow)
|
||||
shadow_remainder=$(lxc exec "$CONTAINER" -- bash -c "grep $SSH_USER /etc/shadow | cut -d':' -f3-")
|
||||
lxc exec "$CONTAINER" -- /opt/debian-bash/tools/append_or_replace "^$SSH_USER:.*:" "$SSH_USER:$shadow_passwd:$shadow_remainder" /etc/shadow >/dev/null
|
||||
|
||||
lxc exec "$CONTAINER" -- /opt/debian-bash/tools/idem_apt_install openssh-server
|
||||
previous_users=($(
|
||||
lxc exec "$CONTAINER" -- bash <<EOF
|
||||
set -Eeuo pipefail
|
||||
if [[ -f /etc/ssh/sshd_config ]] && grep -q AllowUsers /etc/ssh/sshd_config ; then
|
||||
cat /etc/ssh/sshd_config | grep AllowUsers | cut -d' ' -f 2-
|
||||
fi
|
||||
EOF
|
||||
))
|
||||
|
||||
if containsElement previous_users "$SSH_USER"; then
|
||||
echo "sshd_config: AllowUsers $SSH_USER already done!"
|
||||
else
|
||||
echo "previous_users ${previous_users[*]}"
|
||||
previous_users+=("$SSH_USER")
|
||||
echo -n "building template for sshd_config..."
|
||||
USERS=${previous_users[*]} tera -e --env-key env -t "$MIAOU_BASEDIR/templates/dev-container-ssh/sshd_config.j2" -o "/tmp/sshd_config" "$MIAOU_CONFIGDIR/miaou.expanded.yaml" >/dev/null
|
||||
echo 'OK'
|
||||
echo -n "copying sshd_config over container <$CONTAINER> ... "
|
||||
lxc file push --uid 0 --gid 0 "/tmp/sshd_config" "$CONTAINER/etc/ssh/sshd_config" &>/dev/null
|
||||
echo 'OK'
|
||||
lxc exec "$CONTAINER" -- systemctl reload sshd.service
|
||||
fi
|
||||
|
||||
lxc exec "$CONTAINER" -- mkdir -p "/home/$SSH_USER/.ssh"
|
||||
lxc exec "$CONTAINER" -- chown "$SSH_USER:$SSH_USER" "/home/$SSH_USER/.ssh"
|
||||
lxc exec "$CONTAINER" -- chmod 760 "/home/$SSH_USER/.ssh"
|
||||
lxc file push --uid 0 --gid 0 "/home/$miaou_user/.ssh/id_rsa.pub" "$CONTAINER/home/$SSH_USER/.ssh/authorized_keys" &>/dev/null
|
||||
lxc exec "$CONTAINER" -- chown "$SSH_USER:$SSH_USER" "/home/$SSH_USER/.ssh/authorized_keys"
|
||||
lxc exec "$CONTAINER" -- chmod 600 "/home/$SSH_USER/.ssh/authorized_keys"
|
||||
|
||||
echo "create symbolic link for curl from TOOLBOX as required for Codium remote-ssh"
|
||||
lxc exec "$CONTAINER" -- ln -sf /TOOLBOX/curl /usr/bin/
|
||||
|
||||
echo "SUCCESS: container $CONTAINER listening on port 22"
|
||||
}
|
||||
|
||||
## MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
arg1_required "$@"
|
||||
readonly CONTAINER=$1
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
readonly SSH_USER=$(id -un)
|
||||
else
|
||||
readonly SSH_USER="$2"
|
||||
fi
|
||||
|
||||
check
|
||||
enable_ssh
|
||||
Executable
+3
@@ -0,0 +1,3 @@
|
||||
#!/bin/bash
|
||||
|
||||
lxc list -c nDm -f compact status=running | tail -n+2 | sort -k2 -h -r
|
||||
Executable
+3
@@ -0,0 +1,3 @@
|
||||
#!/bin/bash
|
||||
|
||||
lxc list -c nmD -f compact status=running | tail -n+2 | sort -k2 -h -r
|
||||
Executable
+12
@@ -0,0 +1,12 @@
|
||||
#!/bin/bash
|
||||
|
||||
function restart_dnsmasq() {
|
||||
echo -n "lxd: restart dnsmasq... "
|
||||
lxc network get lxdbr0 raw.dnsmasq >/tmp/dnsmaq.conf
|
||||
lxc network set lxdbr0 raw.dnsmasq - </tmp/dnsmaq.conf
|
||||
echo "OK"
|
||||
}
|
||||
|
||||
## MAIN
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
restart_dnsmasq
|
||||
Executable
+479
@@ -0,0 +1,479 @@
|
||||
#!/bin/bash
|
||||
|
||||
usage() {
|
||||
PREFIX="miaou:usage" echo '<init>'
|
||||
exit 0
|
||||
}
|
||||
|
||||
yqm() {
|
||||
#read only
|
||||
yq "$1" "$EXPANDED_CONF"
|
||||
}
|
||||
|
||||
yqmi() {
|
||||
# for update
|
||||
yq "$1" "$EXPANDED_CONF" -i
|
||||
}
|
||||
|
||||
yqmt() {
|
||||
# tabular
|
||||
yq "$1" "$EXPANDED_CONF" -o t
|
||||
}
|
||||
|
||||
compute_fqdn_middlepart() {
|
||||
case "$1" in
|
||||
prod)
|
||||
local fqdn_middlepart="."
|
||||
;;
|
||||
beta)
|
||||
local fqdn_middlepart=".beta."
|
||||
;;
|
||||
dev)
|
||||
local fqdn_middlepart=".dev."
|
||||
;;
|
||||
*)
|
||||
echowarn "unknown target <${target}>, please fix with correct value from {prod, beta, dev} and try again..."
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
builtin echo "$fqdn_middlepart"
|
||||
}
|
||||
|
||||
# archive_conf(FILE)
|
||||
# save patch in archived folder of current file
|
||||
function archive_conf() {
|
||||
PREFIX="miaou:conf:archive"
|
||||
|
||||
file="$1"
|
||||
filename=$(basename "$file")
|
||||
mkdir -p "$MIAOU_CONFIGDIR/archived/$filename"
|
||||
previous="$MIAOU_CONFIGDIR/archived/$filename/previous"
|
||||
|
||||
# shellcheck disable=SC2012
|
||||
latest_patch=$(ls -1tr "$MIAOU_CONFIGDIR/archived/$filename/" | tail -n1)
|
||||
|
||||
if [[ -z "$latest_patch" ]]; then
|
||||
echo -n "archiving first file <$file> ..."
|
||||
cp "$file" "$previous"
|
||||
PREFIX="" echoinfo OK
|
||||
elif [[ "$file" -nt "$latest_patch" ]]; then
|
||||
patchname="$MIAOU_CONFIGDIR/archived/$filename/$(date +%F_%T)"
|
||||
if ! diff "$previous" "$file" >"$patchname"; then
|
||||
echo -n "archiving patch <$patchname> ..."
|
||||
cp "$file" "$previous"
|
||||
PREFIX="" echoinfo OK
|
||||
else
|
||||
rm "$patchname"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
function archive_allconf() {
|
||||
mkdir -p "$MIAOU_CONFIGDIR"
|
||||
archive_conf "$CONF"
|
||||
archive_conf "$DEFAULTS"
|
||||
}
|
||||
|
||||
function check_expand_conf() {
|
||||
PREFIX="miaou:conf:check"
|
||||
if ! "$FORCE" && [ -f "$EXPANDED_CONF" ] && [ "$EXPANDED_CONF" -nt "$CONF" ] && [ "$EXPANDED_CONF" -nt "$DEFAULTS" ]; then
|
||||
echo "already expanded!"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
function expand_conf() {
|
||||
PREFIX="miaou:conf"
|
||||
|
||||
if [[ -f "$EXPANDED_CONF" ]]; then
|
||||
current_target=$(grep -Es "^target:" /etc/miaou/defaults.yaml | cut -d ' ' -f2)
|
||||
previous_target=$(grep -Es "^target:" "$EXPANDED_CONF" | cut -d ' ' -f2)
|
||||
[[ "$current_target" != "$previous_target" ]] && echoerr "TARGET <$previous_target> mismatched <$current_target>" && exit 101
|
||||
fi
|
||||
|
||||
# initialize expanded conf by merging default
|
||||
# shellcheck disable=SC2016
|
||||
yq eval-all '. as $item ireduce ({}; . * $item )' "$CONF" "$DEFAULTS" >"$EXPANDED_CONF"
|
||||
|
||||
# append unique container unless overridden
|
||||
mapfile -t services_app_only < <(yqmt '.services.[].[] | has("container") | select ( . == false) | [(parent|key)+" " +key]')
|
||||
|
||||
for i in "${services_app_only[@]}"; do
|
||||
read -r -a item <<<"$i"
|
||||
domain=${item[0]}
|
||||
subdomain=${item[1]}
|
||||
app=$(yqm ".services.\"$domain\".\"$subdomain\".app")
|
||||
container=$(get_container_for_domain_subdomain_app "$domain" "$subdomain" "$app")
|
||||
yqmi ".services.\"$domain\".\"$subdomain\".container=\"$container\""
|
||||
done
|
||||
|
||||
# append enabled=true unless overridden
|
||||
mapfile -t services_app_only < <(yqmt '.services.[].[] | has("enabled") | select ( . == false) | [(parent|key)+" " +key] | unique ')
|
||||
# echo "found <${#services_app_only[@]}> enabled services"
|
||||
for i in "${services_app_only[@]}"; do
|
||||
read -r -a item <<<"$i"
|
||||
domain=${item[0]}
|
||||
subdomain=${item[1]}
|
||||
yqmi ".services.\"$domain\".\"$subdomain\".enabled=true"
|
||||
done
|
||||
|
||||
# compute fqdn
|
||||
target=$(yqm '.target')
|
||||
fqdn_middlepart=$(compute_fqdn_middlepart "$target")
|
||||
|
||||
# write fqdn_middlepart
|
||||
yqmi ".expanded.fqdn_middlepart = \"$fqdn_middlepart\""
|
||||
|
||||
# add monitored.containers section
|
||||
yqmi '.expanded.monitored.containers = ([ .services[] | to_entries | .[] | .value | select (.enabled == true ) | .container ] | unique)'
|
||||
|
||||
# add monitored.hosts section
|
||||
yqmi '.expanded.monitored.hosts = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app })]'
|
||||
|
||||
# add services section
|
||||
if [[ ${#services_app_only[@]} -gt 0 ]]; then
|
||||
yqmi '.expanded.services = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app, "name": .name // ""})]'
|
||||
else
|
||||
yqmi '.expanded.services = []'
|
||||
fi
|
||||
|
||||
# add firewall section, bridge_subnet + mail_passthrough if any
|
||||
bridge_subnet=$(lxc network get lxdbr0 ipv4.address)
|
||||
yqmi ".firewall.bridge_subnet = \"$bridge_subnet\""
|
||||
|
||||
container_mail_passthrough=$(yqm ".firewall.container_mail_passthrough")
|
||||
}
|
||||
|
||||
function build_routes() {
|
||||
PREFIX="miaou:routes"
|
||||
|
||||
mapfile -t fqdns < <(yqm '.expanded.services[].fqdn')
|
||||
echo "found <${#fqdns[@]}> fqdn"
|
||||
raw_dnsmasq=''
|
||||
for i in "${fqdns[@]}"; do
|
||||
raw_dnsmasq+="address=/$i/$DMZ_IP\\n"
|
||||
# append domains to conf
|
||||
echo "re-routing any connection from <$i> to internal container <$DMZ_CONTAINER.lxd>"
|
||||
done
|
||||
|
||||
builtin echo -e "$raw_dnsmasq" | lxc network set $BRIDGE raw.dnsmasq -
|
||||
}
|
||||
|
||||
function build_dmz_reverseproxy() {
|
||||
PREFIX="miaou:build:dmz"
|
||||
echo -n "building configuration for nginx ... "
|
||||
mkdir -p "$MIAOU_CONFIGDIR/nginx"
|
||||
tera -t "$MIAOU_BASEDIR/templates/nginx/_default.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/_default" &>/dev/null
|
||||
|
||||
tera -t "$MIAOU_BASEDIR/templates/nginx/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nginx/hosts" &>/dev/null
|
||||
PREFIX="" echo OK
|
||||
|
||||
echo -n "pushing configuration to <$DMZ_CONTAINER> ... "
|
||||
for f in "$MIAOU_CONFIGDIR"/nginx/*; do
|
||||
lxc file push --uid=0 --gid=0 "$f" "$DMZ_CONTAINER/etc/nginx/sites-available/" &>/dev/null
|
||||
done
|
||||
PREFIX="" echo OK
|
||||
|
||||
cat <<EOF | PREFIX="miaou:build:dmz" lxc_exec "$DMZ_CONTAINER"
|
||||
cd /etc/nginx/sites-enabled/
|
||||
for i in ../sites-available/*; do
|
||||
# echo dmz: enabling... \$i
|
||||
ln -sf \$i
|
||||
done
|
||||
nginx -tq
|
||||
systemctl restart nginx
|
||||
EOF
|
||||
echo "nginx reloaded successfully!"
|
||||
}
|
||||
|
||||
function monit_show() {
|
||||
PREFIX="monit:show"
|
||||
: $PREFIX
|
||||
|
||||
readarray -t hosts < <(yqmt '.expanded.monitored.hosts[] | [ .container, .port, .fqdn, .app ]')
|
||||
echo "================="
|
||||
echo "${#hosts[@]} available hosts"
|
||||
echo "================="
|
||||
|
||||
for host in "${hosts[@]}"; do
|
||||
read -r -a item <<<"$host"
|
||||
container=${item[0]}
|
||||
port=${item[1]}
|
||||
fqdn=${item[2]}
|
||||
app=${item[3]}
|
||||
|
||||
[[ -n ${PREFIX:-} ]] && printf "${DARK}%25.25s${NC} " "${PREFIX}"
|
||||
|
||||
if curl -m $MAX_WAIT -I -4so /dev/null "http://$container:$port"; then
|
||||
builtin echo -ne "${GREEN}✔${NC}"
|
||||
else
|
||||
builtin echo -ne "${RED}✘${NC}"
|
||||
fi
|
||||
printf "\t%10.10s\thttps://%-40s\thttp://%s\n" "$app" "$fqdn" "$container:$port"
|
||||
done
|
||||
|
||||
}
|
||||
|
||||
function build_monit() {
|
||||
|
||||
# test whether monitored items actually run safely
|
||||
PREFIX="monit:build"
|
||||
echo -n "testing monitored hosts ..."
|
||||
readarray -t hosts < <(yqmt '.expanded.monitored.hosts[] | [ .container, .port, .fqdn ]')
|
||||
for host in "${hosts[@]}"; do
|
||||
read -r -a item <<<"$host"
|
||||
container=${item[0]}
|
||||
port=${item[1]}
|
||||
fqdn=${item[2]}
|
||||
|
||||
if ! (lxc exec "$container" -- ss -tln | grep -q "\(0.0.0.0\|*\):$port"); then
|
||||
echoerr
|
||||
echoerr "no HTTP server responds on <$container.lxd:$port>"
|
||||
echoerr "please review configuration <miaou.yaml> for fqdn: $fqdn"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if ! curl_check_unsecure "https://$fqdn"; then
|
||||
echoerr
|
||||
echoerr "DMZ does not seem to dispatch <https://$fqdn> please review DMZ Nginx proxy"
|
||||
exit 3
|
||||
elif [[ "$target" != 'dev' ]] && ! curl_check "https://$fqdn"; then
|
||||
PREFIX="" echo
|
||||
echowarn "T=$target missing valid certificate for fqdn <https://$fqdn> please review DMZ certbot"
|
||||
fi
|
||||
|
||||
done
|
||||
PREFIX="" echo OK
|
||||
|
||||
# templates for monit
|
||||
echo -n "copying templates for monit ..."
|
||||
mkdir -p "$MIAOU_CONFIGDIR/monit"
|
||||
tera -t "$MIAOU_BASEDIR/templates/monit/containers.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/containers" >/dev/null
|
||||
tera -t "$MIAOU_BASEDIR/templates/monit/hosts.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/monit/hosts" >/dev/null
|
||||
PREFIX="" echo OK
|
||||
}
|
||||
|
||||
# count_service_for_container(container: string)
|
||||
# returns how many services run inside container according to expanded conf
|
||||
function count_service_for_container() {
|
||||
container_mail_passthrough="$1"
|
||||
count=$(yqm ".expanded.services.[] | select(.container == \"$container_mail_passthrough\") | .fqdn" | wc -l)
|
||||
builtin echo "$count"
|
||||
}
|
||||
|
||||
function build_nftables() {
|
||||
PREFIX="miaou:nftables:build"
|
||||
mkdir -p "$MIAOU_CONFIGDIR/nftables.rules.d"
|
||||
|
||||
container_mail_passthrough=$(yqm '.firewall.container_mail_passthrough')
|
||||
if [[ "$container_mail_passthrough" != null ]]; then
|
||||
ip_mail_passthrough=$(lxc list "$container_mail_passthrough" -c4 -f csv | grep eth0 | cut -d ' ' -f1)
|
||||
[[ -z "$ip_mail_passthrough" ]] && echoerr "container <$container_mail_passthrough> passthrough unknown ip!" && exit 55
|
||||
echo "passthrough=$container_mail_passthrough/$ip_mail_passthrough"
|
||||
|
||||
count=$(count_service_for_container "$container_mail_passthrough")
|
||||
[[ $count == 0 ]] && echowarn "no service detected => no passthrough, no change!"
|
||||
[[ $count -gt 1 ]] && echoerr "count <$count> services detected on container <$container_mail_passthrough>, please disable some and leave only one service for safety!!!" && exit 56
|
||||
|
||||
ip_mail_passthrough=$ip_mail_passthrough tera -e --env-key env -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null
|
||||
else
|
||||
echo "no container passthrough"
|
||||
tera -t "$MIAOU_BASEDIR/templates/nftables/lxd.table.j2" "$EXPANDED_CONF" -o "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" &>/dev/null
|
||||
fi
|
||||
|
||||
if ! diff -q "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" /etc/nftables.rules.d/lxd.table; then
|
||||
sudo_required "reloading nftables"
|
||||
echo -n "reloading nftables..."
|
||||
sudo cp "$MIAOU_CONFIGDIR/nftables.rules.d/lxd.table" /etc/nftables.rules.d/lxd.table
|
||||
sudo systemctl reload nftables
|
||||
PREFIX="" echo OK
|
||||
fi
|
||||
}
|
||||
|
||||
# check whether http server responds 200 OK, required <url>, ie: http://example.com:8001, https://example.com
|
||||
function curl_check() {
|
||||
arg1_required "$@"
|
||||
# echo "curl $1"
|
||||
curl -m $MAX_WAIT -sLI4 "$1" | grep -q "^HTTP.* 200"
|
||||
}
|
||||
|
||||
# check whether https server responds 200 OK, even unsecured certificate (auto-signed in mode DEV)
|
||||
function curl_check_unsecure() {
|
||||
arg1_required "$@"
|
||||
curl -m $MAX_WAIT -skLI4 "$1" | grep -q "^HTTP.* 200"
|
||||
}
|
||||
|
||||
function get_dmz_ip() {
|
||||
if ! container_running "$DMZ_CONTAINER"; then
|
||||
echowarn "Container running dmz <$DMZ_CONTAINER> seems down"
|
||||
echoerr "please \`lxc start $DMZ_CONTAINER\` or initialize first!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
dmz_ip=$(host "$DMZ_CONTAINER.lxd" | cut -d ' ' -f4)
|
||||
if ! valid_ipv4 "$dmz_ip"; then
|
||||
echowarn "dmz seems up but no valid ip <$dmz_ip> found!"
|
||||
echoerr "please fix this networking issue, then retry..."
|
||||
exit 1
|
||||
else
|
||||
builtin echo "$dmz_ip"
|
||||
fi
|
||||
}
|
||||
|
||||
function fetch_container_of_type() {
|
||||
local type="$1"
|
||||
readarray -t dmzs < <(yqm ".containers.[].[] | select(.==\"$type\") | parent | key")
|
||||
case ${#dmzs[@]} in
|
||||
0) : ;;
|
||||
1) builtin echo "${dmzs[0]}" ;;
|
||||
*) for d in "${dmzs[@]}"; do
|
||||
builtin echo "$d"
|
||||
done ;;
|
||||
esac
|
||||
}
|
||||
|
||||
function get_container_for_domain_subdomain_app() {
|
||||
local domain="$1"
|
||||
local subdomain="$2"
|
||||
local app="$3"
|
||||
readarray -t containers < <(fetch_container_of_type "$app")
|
||||
case ${#containers[@]} in
|
||||
0) echoerr "no container of type <$app> found amongst containers for $subdomain.$domain\nHINT : Please, either :\n1. define at least one container for recipe <$app>\n2. remove all services related to recipe <$app>" && exit 1 ;;
|
||||
1) builtin echo "${containers[0]}" ;;
|
||||
*)
|
||||
for d in "${containers[@]}"; do
|
||||
echowarn "container of type $app found in <$d>"
|
||||
done
|
||||
echoerr "multiple containers (${#containers[@]}) provided same app <$app>, therefore container is mandatory alongside $subdomain.$domain" && exit 2
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
function get_unique_container_dmz() {
|
||||
readarray -t containers < <(fetch_container_of_type "dmz")
|
||||
case ${#containers[@]} in
|
||||
0) echoerr "no container of type <dmz> found amongst containers" && exit 1 ;;
|
||||
1) builtin echo "${containers[0]}" ;;
|
||||
|
||||
*)
|
||||
for d in "${containers[@]}"; do
|
||||
echowarn "container of type dmz found in <$d>"
|
||||
done
|
||||
echoerr "multiple dmz (${#containers[@]}) are not allowed, please select only one " && exit 2
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
function prepare_dmz_container() {
|
||||
"$MIAOU_BASEDIR"/recipes/dmz/install.sh "$DMZ_CONTAINER"
|
||||
}
|
||||
|
||||
function check_resolv_conf() {
|
||||
local bridge_gw resolver
|
||||
bridge_gw=$(lxc network get lxdbr0 ipv4.address | cut -d'/' -f1)
|
||||
resolver=$(grep nameserver /etc/resolv.conf | head -n1 | cut -d ' ' -f2)
|
||||
|
||||
PREFIX="resolver:check" echo "container resolver is <$resolver>"
|
||||
PREFIX="resolver:check" echo "container bridge is <$bridge_gw>"
|
||||
[[ "$bridge_gw" != "$resolver" ]] && return 21
|
||||
return 0
|
||||
}
|
||||
|
||||
function prepare_containers() {
|
||||
PREFIX="miaou:prepare"
|
||||
readarray -t containers < <(yqmt ".containers.[] | [ key, .[] ] ")
|
||||
for i in "${containers[@]}"; do
|
||||
read -r -a item <<<"$i"
|
||||
container=${item[0]}
|
||||
for ((j = 1; j < ${#item[@]}; j++)); do
|
||||
service="${item[$j]}"
|
||||
recipe_install="$MIAOU_BASEDIR/recipes/$service/install.sh"
|
||||
if [[ -f "$recipe_install" ]]; then
|
||||
echo "install [$service] onto container <$container>"
|
||||
"$recipe_install" "$container"
|
||||
else
|
||||
echoerr "FAILURE, for container <$container>, install recipe [$service] not found!"
|
||||
echoerr "please review configuration, mismatch recipe name maybe?"
|
||||
exit 50
|
||||
fi
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
function build_services() {
|
||||
PREFIX="miaou:build:services"
|
||||
echo "building services..."
|
||||
readarray -t services < <(yqmt '.expanded.services[] | [ .[] ]')
|
||||
for i in "${services[@]}"; do
|
||||
|
||||
read -r -a item <<<"$i"
|
||||
fqdn=${item[2]}
|
||||
container=${item[3]}
|
||||
port=${item[4]}
|
||||
app=${item[5]}
|
||||
name=${item[6]:-}
|
||||
|
||||
recipe="$MIAOU_BASEDIR/recipes/$app/crud.sh"
|
||||
if [[ -f "$recipe" ]]; then
|
||||
echo "read [$app:$name] onto container <$container>"
|
||||
if ! "$recipe" -r --port "$port" --container "$container" --name "$name" --fqdn "$fqdn"; then
|
||||
echoinfo "CREATE RECIPE"
|
||||
"$recipe" -c --port "$port" --container "$container" --name "$name" --fqdn "$fqdn"
|
||||
echoinfo "CREATE RECIPE: OK"
|
||||
fi
|
||||
else
|
||||
echowarn "for container <$container>, crud recipe [$app] not found!"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
### MAIN
|
||||
|
||||
. "$MIAOU_BASEDIR/lib/init.sh"
|
||||
|
||||
readonly CONF="/etc/miaou/miaou.yaml"
|
||||
readonly DEFAULTS="/etc/miaou/defaults.yaml"
|
||||
readonly EXPANDED_CONF="$MIAOU_CONFIGDIR/miaou.expanded.yaml"
|
||||
readonly BRIDGE="lxdbr0"
|
||||
readonly MAX_WAIT=3 # timeout in seconds
|
||||
|
||||
# shellcheck disable=SC2034
|
||||
declare -a options=("$@")
|
||||
|
||||
FORCE=false
|
||||
if containsElement options "-f" || containsElement options "--force"; then
|
||||
FORCE=true
|
||||
fi
|
||||
|
||||
if containsElement options "history"; then
|
||||
echo "TODO: HISTORY"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if containsElement options "config"; then
|
||||
editor /etc/miaou/miaou.yaml
|
||||
if diff -q /etc/miaou/miaou.yaml $HOME/.config/miaou/archived/miaou.yaml/previous; then
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
if check_expand_conf; then
|
||||
archive_allconf
|
||||
expand_conf
|
||||
check_resolv_conf
|
||||
build_nftables
|
||||
prepare_containers
|
||||
|
||||
DMZ_CONTAINER=$(get_unique_container_dmz)
|
||||
readonly DMZ_CONTAINER
|
||||
build_services
|
||||
|
||||
DMZ_IP=$(get_dmz_ip)
|
||||
readonly DMZ_IP
|
||||
build_dmz_reverseproxy
|
||||
|
||||
build_routes
|
||||
build_monit
|
||||
|
||||
fi
|
||||
monit_show
|
||||
Executable
+80
@@ -0,0 +1,80 @@
|
||||
#!/bin/bash
|
||||
readonly DOMAIN=$1
|
||||
readonly PROTOCOL=${2:-https}
|
||||
readonly TIMEOUT=10 # max seconds to wait
|
||||
|
||||
result=0
|
||||
|
||||
function usage {
|
||||
echo 'usage: <DOMAIN> [ https | 443 | smtps | 587 | pop3 | 993 | imap | 995 | ALL ]'
|
||||
exit -1
|
||||
}
|
||||
|
||||
function check_ssl {
|
||||
local protocol=$1
|
||||
case $protocol in
|
||||
SMTPS )
|
||||
local extra="-starttls smtp -showcerts"
|
||||
;;
|
||||
esac
|
||||
|
||||
echo -n "$protocol "
|
||||
|
||||
|
||||
certificate_info=$(echo | timeout $TIMEOUT openssl s_client $extra -connect $DOMAIN:$2 2>/dev/null)
|
||||
|
||||
issuer=$(echo "$certificate_info" | openssl x509 -noout -text 2>/dev/null | grep Issuer: | cut -d: -f2)
|
||||
date=$( echo "$certificate_info" | openssl x509 -noout -enddate 2>/dev/null | cut -d'=' -f2)
|
||||
date_s=$(date -d "${date}" +%s)
|
||||
now_s=$(date -d now +%s)
|
||||
date_diff=$(( (date_s - now_s) / 86400 ))
|
||||
|
||||
if [[ -z $date ]]; then
|
||||
echo -n "does not respond "
|
||||
echo -ne "\033[31;1m"
|
||||
echo FAILURE
|
||||
(( result += 1 ))
|
||||
elif [[ $date_diff -gt 20 ]]; then
|
||||
echo -n "issuer:$issuer "
|
||||
echo -n "will expire in $date_diff days "
|
||||
echo -ne "\033[32;1m"
|
||||
echo ok
|
||||
elif [[ $date_diff -gt 0 ]];then
|
||||
echo -n "issuer:$issuer "
|
||||
echo -n "will expire in $date_diff days "
|
||||
echo -ne "\033[31;1m"
|
||||
echo WARNING
|
||||
(( result += 1 ))
|
||||
else
|
||||
echo -n "issuer:$issuer "
|
||||
echo -n "has already expired $date_diff ago "
|
||||
echo -ne "\033[31;1m"
|
||||
echo FAILURE
|
||||
(( result += 1 ))
|
||||
fi
|
||||
echo -ne "\033[0m"
|
||||
}
|
||||
|
||||
#MAIN
|
||||
[[ -z "$DOMAIN" ]] && usage
|
||||
case $PROTOCOL in
|
||||
https | 443 )
|
||||
check_ssl HTTPS 443;;
|
||||
smtps | 587 )
|
||||
check_ssl SMTPS 587;;
|
||||
pop3 | 995 )
|
||||
check_ssl POP3 995;;
|
||||
imap | 993 )
|
||||
check_ssl IMAP 993;;
|
||||
all | ALL )
|
||||
check_ssl HTTPS 443
|
||||
check_ssl SMTPS 587
|
||||
check_ssl POP3 995
|
||||
check_ssl IMAP 993
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
|
||||
exit "$result"
|
||||
@@ -0,0 +1,18 @@
|
||||
#!/bin/bash
|
||||
|
||||
case $1 in
|
||||
minute) ;;
|
||||
daily) ;;
|
||||
*) echo "expected [minute|daily]" && exit 1 ;;
|
||||
esac
|
||||
|
||||
SELECTOR=$1
|
||||
|
||||
for i in /var/www/cagettepei/*; do
|
||||
if [[ -d $i ]]; then
|
||||
cd "$i/www" || echo "Folder not found: $i/www"
|
||||
echo "cron-$SELECTOR in: $i"
|
||||
neko index.n cron/$SELECTOR
|
||||
echo
|
||||
fi
|
||||
done
|
||||
@@ -0,0 +1,8 @@
|
||||
Listen {{ env.APP_PORT }}
|
||||
<VirtualHost *:{{ env.APP_PORT }}>
|
||||
DirectoryIndex index.n
|
||||
DocumentRoot /var/www/cagettepei/{{env.APP_NAME}}/www/
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/cagettepei/{{env.APP_NAME}}/debug.log
|
||||
ErrorLogFormat "[%{uc}t] %M"
|
||||
</VirtualHost>
|
||||
@@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=Run batch cagettepei every day
|
||||
|
||||
[Service]
|
||||
User=www-data
|
||||
SyslogIdentifier=cagettepei
|
||||
ExecStart=/var/www/cagettepei/cagettepei-batch daily
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=Timer for batch cagettepei every day
|
||||
Requires=apache2.service
|
||||
|
||||
[Timer]
|
||||
OnCalendar=daily
|
||||
Unit=cagettepei-batch-day.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=Run batch cagettepei every minute
|
||||
|
||||
[Service]
|
||||
User=www-data
|
||||
SyslogIdentifier=cagettepei
|
||||
ExecStart=/var/www/cagettepei/cagettepei-batch minute
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=Timer for batch cagettepei every minute
|
||||
Requires=apache2.service
|
||||
|
||||
[Timer]
|
||||
OnCalendar=minutely
|
||||
Unit=cagettepei-batch-minute.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -0,0 +1,23 @@
|
||||
server {
|
||||
listen {{ APP_PORT }} default_server;
|
||||
|
||||
root /var/www/{{APP_NAME}}/htdocs; # Check this
|
||||
error_log /var/log/nginx/{{APP_NAME}}/error.log;
|
||||
|
||||
index index.php index.html index.htm;
|
||||
charset utf-8;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php;
|
||||
}
|
||||
|
||||
location ~ [^/]\.php(/|$) {
|
||||
client_max_body_size 50M;
|
||||
try_files $uri =404;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_read_timeout 600;
|
||||
include fastcgi_params;
|
||||
fastcgi_pass unix:/var/run/php/php{{PHP_VERSION}}-fpm.sock;
|
||||
}
|
||||
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.1 KiB |
@@ -0,0 +1,17 @@
|
||||
[options]
|
||||
data_dir = /home/odoo/data-{{ APP_NAME }}
|
||||
|
||||
xmlrpc_port = {{ APP_PORT }}
|
||||
longpolling_port = {{ LONG_PORT }}
|
||||
|
||||
db_host = ct1.lxd
|
||||
db_name = odoo12-{{ APP_NAME }}
|
||||
db_user = odoo12-{{ APP_NAME }}
|
||||
db_password = odoo12-{{ APP_NAME }}
|
||||
list_db = {{ target != 'prod'}}
|
||||
|
||||
workers = 2
|
||||
db_maxconn = 10
|
||||
db_filter = .*
|
||||
syslog = True
|
||||
proxy_mode = True
|
||||
@@ -0,0 +1,14 @@
|
||||
[Unit]
|
||||
Description=Odoo12 {{ APP_NAME }}
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
SyslogIdentifier=odoo12-{{ APP_NAME }}
|
||||
PermissionsStartOnly=true
|
||||
User=odoo
|
||||
Group=odoo
|
||||
ExecStart=/home/odoo/venv/bin/python3 /home/odoo/odoo12/odoo-bin -c /etc/odoo12/{{ APP_NAME }}.conf
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,31 @@
|
||||
#!/bin/bash
|
||||
|
||||
CLIENT=$1
|
||||
ADDON=$2
|
||||
|
||||
function usage() {
|
||||
echo 'usage: <CLIENT> <ADDON>'
|
||||
exit 1
|
||||
}
|
||||
|
||||
# VERIFICATION
|
||||
|
||||
[[ -z "$CLIENT" || -z "$ADDON" ]] && usage
|
||||
[[ ! -d "/home/odoo/data-${CLIENT}" ]] && echo "unknown CLIENT <${CLIENT}>, should exist in folder /home/odoo/data-..." && exit 2
|
||||
|
||||
URL="https://pypi.org/project/odoo12-addon-${ADDON}/"
|
||||
curl --output /dev/null --silent --head --fail "${URL}"
|
||||
[[ $? -ne 0 ]] && echo "unknown ADDON <${ADDON}>, should be downloadable from: ${URL}" && exit 3
|
||||
|
||||
[[ -d "/home/odoo/data-${CLIENT}/addons/12.0/${ADDON}" ]] && echo "ADDON <${ADDON}> already exists, consider removing manually!" && exit 4
|
||||
|
||||
# ACTION
|
||||
|
||||
package=$(curl -Ls ${URL} | rg '<a href="(https://files.pythonhosted.org/.*)">' -r '$1')
|
||||
wget $package -O /tmp/package.zip
|
||||
rm /tmp/ADDON -rf && mkdir /tmp/ADDON
|
||||
unzip /tmp/package.zip 'odoo/addons/*' -d /tmp/ADDON/
|
||||
chown -R odoo:odoo /tmp/ADDON/
|
||||
mv /tmp/ADDON/odoo/addons/* /home/odoo/data-${CLIENT}/addons/12.0/
|
||||
|
||||
echo "FORCE RELOADING ADDONS with: ./web?debug#menu_id=48&action=36"
|
||||
@@ -0,0 +1,33 @@
|
||||
#!/bin/bash
|
||||
|
||||
CLIENT=$1
|
||||
ADDON=$2
|
||||
|
||||
function usage() {
|
||||
echo 'usage: <CLIENT> <ADDON>'
|
||||
exit 100
|
||||
}
|
||||
|
||||
# VERIFICATION
|
||||
|
||||
[[ -z "$CLIENT" || -z "$ADDON" ]] && usage
|
||||
[[ ! -d "/home/odoo/data-${CLIENT}" ]] && echo "unknown CLIENT <${CLIENT}>, should exist in folder /home/odoo/data-..." && exit 2
|
||||
|
||||
URL="https://pypi.org/project/odoo-addon-${ADDON}/"
|
||||
curl --output /dev/null --silent --head --fail "${URL}"
|
||||
[[ $? -ne 0 ]] && echo "unknown ADDON <${ADDON}>, should be downloadable from: ${URL}" && exit 3
|
||||
|
||||
[[ -d "/home/odoo/data-${CLIENT}/addons/15.0/${ADDON}" ]] && echo "ADDON <${ADDON}> already exists, consider removing manually!" && exit 4
|
||||
|
||||
# ACTION
|
||||
|
||||
package=$(curl -Ls "$URL" | rg '<a href="(https://files.pythonhosted.org/.*)">' -r '$1')
|
||||
wget $package -O /tmp/package.zip
|
||||
rm /tmp/ADDON -rf && mkdir /tmp/ADDON
|
||||
unzip /tmp/package.zip 'odoo/addons/*' -d /tmp/ADDON/
|
||||
real_name=$(unzip -l /tmp/package.zip | head -n4 | tail -n1 | cut -d'/' -f3)
|
||||
chown -R odoo:odoo /tmp/ADDON/
|
||||
mv /tmp/ADDON/odoo/addons/* "/home/odoo/data-$CLIENT/addons/15.0/"
|
||||
|
||||
# ADD
|
||||
su odoo -c "python3.9 /home/odoo/odoo15/odoo-bin -c /etc/odoo15/$CLIENT.conf -i $real_name -d odoo15-$CLIENT --worker=0 --stop-after-init"
|
||||
@@ -0,0 +1,17 @@
|
||||
[options]
|
||||
data_dir = /home/odoo/data-{{ APP_NAME }}
|
||||
|
||||
xmlrpc_port = {{ APP_PORT }}
|
||||
longpolling_port = {{ LONG_PORT }}
|
||||
|
||||
db_host = ct1.lxd
|
||||
db_name = odoo15-{{ APP_NAME }}
|
||||
db_user = odoo15-{{ APP_NAME }}
|
||||
db_password = odoo15-{{ APP_NAME }}
|
||||
list_db = {{ target != 'prod'}}
|
||||
|
||||
workers = 2
|
||||
db_maxconn = 10
|
||||
db_filter = .*
|
||||
syslog = True
|
||||
proxy_mode = True
|
||||
@@ -0,0 +1,14 @@
|
||||
[Unit]
|
||||
Description=Odoo15 {{ APP_NAME }}
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
SyslogIdentifier=odoo15-{{ APP_NAME }}
|
||||
PermissionsStartOnly=true
|
||||
User=odoo
|
||||
Group=odoo
|
||||
ExecStart=python3.9 /home/odoo/odoo15/odoo-bin -c /etc/odoo15/{{ APP_NAME }}.conf
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,44 @@
|
||||
#!/bin/bash
|
||||
|
||||
function detectWordpress() {
|
||||
local result=$(pwd)
|
||||
while [[ ! ("$result" == / || -f "$result/wp-config.php") ]]; do
|
||||
result=$(dirname "$result")
|
||||
done
|
||||
|
||||
if [[ "$result" == / ]]; then
|
||||
echo >&2 "no WORDPRESS detected from current folder <$(pwd)>!"
|
||||
exit 100
|
||||
fi
|
||||
|
||||
echo "$result"
|
||||
}
|
||||
|
||||
## MAIN
|
||||
## ----
|
||||
|
||||
set -Eeuo pipefail
|
||||
WP_BASE=$(detectWordpress)
|
||||
WP_CONFIG="$WP_BASE/wp-config.php"
|
||||
DB_HOST=$(grep DB_HOST $WP_CONFIG | cut -d"'" -f4)
|
||||
DB_NAME=$(grep DB_NAME $WP_CONFIG | cut -d"'" -f4)
|
||||
DB_USER=$(grep DB_USER $WP_CONFIG | cut -d"'" -f4)
|
||||
DB_PASSWORD=$(grep DB_PASSWORD $WP_CONFIG | cut -d"'" -f4)
|
||||
TODAY=$(date +%F)
|
||||
BACKUP_DIR="/mnt/SHARED/wordpress-backup/$DB_NAME-$TODAY"
|
||||
|
||||
[[ -d "$BACKUP_DIR" ]] && find "$BACKUP_DIR" -mindepth 1 -delete || mkdir -p "$BACKUP_DIR"
|
||||
|
||||
echo -n "backing up database..."
|
||||
mariadb-dump -h "$DB_HOST" -u "$DB_NAME" -p"$DB_PASSWORD" "$DB_NAME" | gzip >"$BACKUP_DIR/$DB_NAME".mariadb.gz
|
||||
echo OK
|
||||
|
||||
echo -n "compressing as tar.gz the wp-content folder ..."
|
||||
tar -czvf "$BACKUP_DIR/wp-content.tgz" -C "$WP_BASE" wp-content
|
||||
echo OK
|
||||
|
||||
echo -n "copying wp-config.php file ..."
|
||||
cp "$WP_BASE/wp-config.php" "$BACKUP_DIR"
|
||||
echo OK
|
||||
|
||||
echo "successful backup in $BACKUP_DIR, db + wp-content + wp-config"
|
||||
@@ -0,0 +1,37 @@
|
||||
server {
|
||||
listen {{ env.APP_PORT }} default_server;
|
||||
|
||||
access_log /var/log/nginx/{{ env.APP_NAME }}/wp-access.log;
|
||||
error_log /var/log/nginx/{{ env.APP_NAME }}/wp-error.log;
|
||||
|
||||
client_max_body_size 50M;
|
||||
root /var/www/wordpress/{{ env.APP_NAME }};
|
||||
index index.php index.html index.htm;
|
||||
charset UTF-8;
|
||||
|
||||
location / {
|
||||
try_files $uri/ /index.php?$args;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
try_files $uri =404;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:/run/php/php-fpm.sock;
|
||||
fastcgi_index index.php;
|
||||
include fastcgi.conf;
|
||||
}
|
||||
|
||||
location ~* \.(js|css|png|jpg|jpeg|svg|gif|ico|eot|otf|ttf|woff|woff2|mp3|wav|ogg)$ {
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
access_log off; log_not_found off; expires 30d;
|
||||
}
|
||||
|
||||
# Mailpoet - tinyMCE quick fix
|
||||
location ~ /wp-content/plugins/wysija-newsletters/js/tinymce/.*\.(htm|html)$ {
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
access_log off; log_not_found off; expires 30d;
|
||||
}
|
||||
|
||||
location = /robots.txt { access_log off; log_not_found off; }
|
||||
location ~ /\. { deny all; access_log off; log_not_found off; }
|
||||
}
|
||||
@@ -0,0 +1,176 @@
|
||||
#!/bin/bash
|
||||
|
||||
### error_handling
|
||||
|
||||
function trap_error() {
|
||||
error_code=$1
|
||||
error_line=$2
|
||||
|
||||
if [[ ${error_code} -lt 100 ]]; then
|
||||
printf "\nEXIT #${error_code} due to error at line ${error_line} : \n-----------------------------------------\n"
|
||||
sed "${error_line}q;d" $0
|
||||
echo
|
||||
fi
|
||||
exit $error_code
|
||||
}
|
||||
set -e
|
||||
trap 'trap_error $? $LINENO' ERR
|
||||
|
||||
### ------------------
|
||||
|
||||
function detectWordpress() {
|
||||
local result=$(pwd)
|
||||
while [[ ! ("$result" == / || -f "$result/wp-config.php") ]]; do
|
||||
result=$(dirname "$result")
|
||||
done
|
||||
|
||||
if [[ "$result" == / ]]; then
|
||||
echo >&2 "no WORDPRESS detected!"
|
||||
exit 100
|
||||
fi
|
||||
|
||||
echo "$result"
|
||||
}
|
||||
|
||||
function getConfigComment() {
|
||||
local result=$(grep -e "^#" $WP_CONFIG | grep "$1" | head -n1 | cut -d ',' -f2 | cut -d \' -f2)
|
||||
if [[ -z "$result" ]]; then
|
||||
echo "config comment: $1 not found!"
|
||||
exit 2
|
||||
fi
|
||||
echo "$result"
|
||||
}
|
||||
function getConfigEntry() {
|
||||
local result=$(grep "$1" $WP_CONFIG | head -n1 | cut -d ',' -f2 | cut -d \' -f2)
|
||||
if [[ -z "$result" ]]; then
|
||||
echo "config entry: $1 not found!"
|
||||
exit 2
|
||||
fi
|
||||
echo "$result"
|
||||
}
|
||||
|
||||
function sql() {
|
||||
local result=$(echo "$1" | mysql -srN -u $DB_USER -h $DB_HOST $DB_NAME -p$DB_PASS 2>&1)
|
||||
if [[ $result =~ ^ERROR ]]; then
|
||||
echo >&2 "sql failure: $result"
|
||||
exit 3
|
||||
else
|
||||
echo "$result"
|
||||
fi
|
||||
}
|
||||
|
||||
function sqlFile() {
|
||||
local result=$(cat "$1" | mysql -srN -u $DB_USER -h $DB_HOST $DB_NAME -p$DB_PASS 2>&1)
|
||||
if [[ $result =~ ^ERROR ]]; then
|
||||
echo >&2 "sql failure: $result"
|
||||
exit 3
|
||||
else
|
||||
echo "$result"
|
||||
fi
|
||||
}
|
||||
function changeHome() {
|
||||
local FROM=$1
|
||||
local TO=$2
|
||||
sql "UPDATE wp_options SET option_value = replace(option_value, '$FROM', '$TO') WHERE option_name = 'home' OR option_name = 'siteurl'"
|
||||
sql "UPDATE wp_posts SET guid = replace(guid, '$FROM','$TO')"
|
||||
sql "UPDATE wp_posts SET post_content = replace(post_content, '$FROM', '$TO')"
|
||||
sql "UPDATE wp_postmeta SET meta_value = replace(meta_value,'$FROM','$TO')"
|
||||
}
|
||||
|
||||
function lastMigration() {
|
||||
sql "SELECT migration_file FROM migrations ORDER BY last_run DESC LIMIT 1"
|
||||
}
|
||||
|
||||
function upgradeMigration() {
|
||||
local LAST_MIGRATION=$1
|
||||
local UPGRADE=false
|
||||
if [[ "$LAST_MIGRATION" == '' ]]; then
|
||||
UPGRADE=true
|
||||
fi
|
||||
|
||||
local MIG_BASE="$WP_BASE/wp-content/migrations"
|
||||
local MIGRATIONS=$(ls -p1 $MIG_BASE | grep -v /)
|
||||
local MIG_FILE
|
||||
for mig in $MIGRATIONS; do
|
||||
if [[ "$UPGRADE" == true ]]; then
|
||||
printf "applying %50s ... " $mig
|
||||
printf "%d %d" $(sqlFile $MIG_BASE/$mig)
|
||||
echo " DONE"
|
||||
MIG_FILE=$mig
|
||||
else
|
||||
printf "useless %50s \n" $mig
|
||||
if [[ "$LAST_MIGRATION" == "$mig" ]]; then
|
||||
UPGRADE=true
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ $UPGRADE == true && $MIG_FILE != '' ]]; then
|
||||
local done=$(sql "INSERT INTO migrations(migration_file, last_run) VALUES ('$mig', NOW())")
|
||||
echo "all migrations succeeded, wrote: $mig"
|
||||
else
|
||||
echo "already up-to-date"
|
||||
fi
|
||||
}
|
||||
|
||||
function buildMigrations() {
|
||||
if [[ ! -d "$WP_BASE"/wp-content/migrations ]]; then
|
||||
mkdir -p "$WP_BASE"/wp-content/migrations
|
||||
echo "migrations folder created!"
|
||||
fi
|
||||
|
||||
sql "CREATE TABLE IF NOT EXISTS migrations (id int(11) NOT NULL AUTO_INCREMENT, migration_file varchar(255) COLLATE utf8_unicode_ci NOT NULL, last_run varchar(45) COLLATE utf8_unicode_ci NOT NULL, PRIMARY KEY (id) )"
|
||||
|
||||
}
|
||||
|
||||
function playEnvironment() {
|
||||
|
||||
buildMigrations
|
||||
|
||||
local PLATFORM=$1
|
||||
local PLATFORM_BASE="$WP_BASE/wp-content/migrations/$PLATFORM"
|
||||
if [[ -d "$PLATFORM_BASE" ]]; then
|
||||
echo play platform $PLATFORM
|
||||
|
||||
local MIGRATIONS=$(ls -p1 $PLATFORM_BASE | grep -v /)
|
||||
for mig in $MIGRATIONS; do
|
||||
printf "applying %50s ... " $mig
|
||||
printf "%d %d" $(sqlFile $PLATFORM_BASE/$mig)
|
||||
echo " DONE"
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
## MAIN
|
||||
## ----
|
||||
|
||||
WP_BASE=$(detectWordpress)
|
||||
WP_CONFIG="$WP_BASE/wp-config.php"
|
||||
echo "WP_BASE = $WP_BASE"
|
||||
|
||||
WP_HOME=$(getConfigComment WP_HOME)
|
||||
echo "WP_HOME = $WP_HOME"
|
||||
|
||||
DB_HOST=$(getConfigEntry DB_HOST)
|
||||
DB_NAME=$(getConfigEntry DB_NAME)
|
||||
DB_USER=$(getConfigEntry DB_USER)
|
||||
DB_PASS=$(getConfigEntry DB_PASSWORD)
|
||||
|
||||
CURRENT_HOME=$(sql "SELECT option_value FROM wp_options WHERE option_name = 'home'")
|
||||
if [[ "$CURRENT_HOME" != "$WP_HOME" ]]; then
|
||||
echo "HOME detected = $CURRENT_HOME , needs to apply changes"
|
||||
$(changeHome "$CURRENT_HOME" "$WP_HOME")
|
||||
fi
|
||||
|
||||
if [[ "$WP_HOME" =~ https?:\/\/beta[0-9]*\..*|https?:\/\/.*\.beta[0-9]*\..* ]]; then
|
||||
playEnvironment BETA
|
||||
else
|
||||
if [[ "$WP_HOME" =~ https?:\/\/dev[0-9]*\..*|https?:\/\/.*\.dev[0-9]*\..* ]]; then
|
||||
playEnvironment DEV
|
||||
else
|
||||
playEnvironment PROD
|
||||
fi
|
||||
fi
|
||||
|
||||
CURRENT_MIGRATION=$(lastMigration)
|
||||
upgradeMigration "$CURRENT_MIGRATION"
|
||||
Executable
+5
@@ -0,0 +1,5 @@
|
||||
#!/bin/sh
|
||||
|
||||
if [ -x /usr/sbin/autopostgresqlbackup ]; then
|
||||
/usr/sbin/autopostgresqlbackup
|
||||
fi
|
||||
@@ -0,0 +1,122 @@
|
||||
# ===============================
|
||||
# === Debian specific options ===
|
||||
#================================
|
||||
|
||||
# By default, on Debian systems, only 'postgres' user
|
||||
# is allowed to access PostgreSQL databases without password.
|
||||
# In order to dump databases we need to run pg_dump/psql
|
||||
# commands as 'postgres' with su.
|
||||
#
|
||||
# The following setting has been added to workraound this issue.
|
||||
# (if it is set to empty, 'su' usage will be disabled)
|
||||
SU_USERNAME=postgres
|
||||
|
||||
#=====================================================================
|
||||
# Set the following variables to your system needs
|
||||
# (Detailed instructions below variables)
|
||||
#=====================================================================
|
||||
|
||||
# Username to access the PostgreSQL server e.g. dbuser
|
||||
USERNAME=postgres
|
||||
|
||||
# Password
|
||||
# create a file $HOME/.pgpass containing a line like this
|
||||
# hostname:*:*:dbuser:dbpass
|
||||
# replace hostname with the value of DBHOST and postgres with
|
||||
# the value of USERNAME
|
||||
|
||||
# Host name (or IP address) of PostgreSQL server e.g localhost
|
||||
DBHOST=localhost
|
||||
|
||||
# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3"
|
||||
DBNAMES="all"
|
||||
|
||||
# pseudo database name used to dump global objects (users, roles, tablespaces)
|
||||
GLOBALS_OBJECTS="postgres_globals"
|
||||
|
||||
# Backup directory location e.g /backups
|
||||
BACKUPDIR="/mnt/BACKUP/postgresql"
|
||||
|
||||
# Mail setup
|
||||
# What would you like to be mailed to you?
|
||||
# - log : send only log file
|
||||
# - files : send log file and sql files as attachments (see docs)
|
||||
# - stdout : will simply output the log to the screen if run manually.
|
||||
# - quiet : Only send logs if an error occurs to the MAILADDR.
|
||||
MAILCONTENT="quiet"
|
||||
|
||||
# Set the maximum allowed email size in k. (4000 = approx 5MB email [see docs])
|
||||
MAXATTSIZE="4000"
|
||||
|
||||
# Email Address to send mail to? (user@domain.com)
|
||||
MAILADDR="root"
|
||||
|
||||
# ============================================================
|
||||
# === ADVANCED OPTIONS ( Read the doc's below for details )===
|
||||
#=============================================================
|
||||
|
||||
# List of DBBNAMES for Monthly Backups.
|
||||
MDBNAMES="$DBNAMES"
|
||||
GLOBALS_OBJECTS_INCLUDE="no"
|
||||
# List of DBNAMES to EXLUCDE if DBNAMES are set to all (must be in " quotes)
|
||||
DBEXCLUDE="postgres template1"
|
||||
|
||||
# Include CREATE DATABASE in backup?
|
||||
CREATE_DATABASE=yes
|
||||
|
||||
# Separate backup directory and file for each DB? (yes or no)
|
||||
SEPDIR=yes
|
||||
|
||||
# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
|
||||
DOWEEKLY=6
|
||||
|
||||
# Choose Compression type. (gzip, bzip2 or xz)
|
||||
COMP=gzip
|
||||
|
||||
# Compress communications between backup server and PostgreSQL server?
|
||||
# set compression level from 0 to 9 (0 means no compression)
|
||||
COMMCOMP=0
|
||||
|
||||
# Additionally keep a copy of the most recent backup in a seperate directory.
|
||||
LATEST=no
|
||||
|
||||
# OPT string for use with pg_dump ( see man pg_dump )
|
||||
OPT=""
|
||||
|
||||
# Backup files extension
|
||||
EXT="sql"
|
||||
|
||||
# Backup files permissions
|
||||
PERM=600
|
||||
|
||||
# Encyrption settings
|
||||
# (inspired by http://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/)
|
||||
#
|
||||
# Once the backup done, each SQL dump will be encrypted and the original file
|
||||
# will be deleted (if encryption was successful).
|
||||
# It is recommended to backup into a staging directory, and then use the
|
||||
# POSTBACKUP script to sync the encrypted files to the desired location.
|
||||
#
|
||||
# Encryption uses private/public keys. You can generate the key pairs like the following:
|
||||
# openssl req -x509 -nodes -days 100000 -newkey rsa:2048 -keyout backup.key -out backup.crt -subj '/'
|
||||
#
|
||||
# Decryption:
|
||||
# openssl smime -decrypt -in backup.sql.gz.enc -binary -inform DEM -inkey backup.key -out backup.sql.gz
|
||||
|
||||
# Enable encryption
|
||||
ENCRYPTION=no
|
||||
|
||||
# Encryption public key
|
||||
ENCRYPTION_PUBLIC_KEY="/etc/ssl/certs/autopostgresqlbackup.crt"
|
||||
|
||||
# Encryption Cipher (see enc manpage)
|
||||
ENCRYPTION_CIPHER="aes256"
|
||||
|
||||
# Suffix for encyrpted files
|
||||
ENCRYPTION_SUFFIX=".enc"
|
||||
|
||||
# Command to run before backups (uncomment to use)
|
||||
#PREBACKUP="/etc/postgresql-backup-pre"
|
||||
|
||||
# Command run after backups (uncomment to use)
|
||||
#POSTBACKUP="/etc/postgresql-backup-post"
|
||||
Executable
+666
@@ -0,0 +1,666 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# PostgreSQL Backup Script Ver 1.0
|
||||
# http://autopgsqlbackup.frozenpc.net
|
||||
# Copyright (c) 2005 Aaron Axelsen <axelseaa@amadmax.com>
|
||||
# 2005 Friedrich Lobenstock <fl@fl.priv.at>
|
||||
# 2013-2019 Emmanuel Bouthenot <kolter@openics.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
#=====================================================================
|
||||
# Set the following variables to your system needs
|
||||
# (Detailed instructions below variables)
|
||||
#=====================================================================
|
||||
|
||||
# Username to access the PostgreSQL server e.g. dbuser
|
||||
USERNAME=postgres
|
||||
|
||||
# Password
|
||||
# create a file $HOME/.pgpass containing a line like this
|
||||
# hostname:*:*:dbuser:dbpass
|
||||
# replace hostname with the value of DBHOST and postgres with
|
||||
# the value of USERNAME
|
||||
|
||||
# Host name (or IP address) of PostgreSQL server e.g localhost
|
||||
DBHOST=localhost
|
||||
|
||||
# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3"
|
||||
DBNAMES="all"
|
||||
|
||||
# pseudo database name used to dump global objects (users, roles, tablespaces)
|
||||
GLOBALS_OBJECTS="postgres_globals"
|
||||
|
||||
# Backup directory location e.g /backups
|
||||
BACKUPDIR="/backups"
|
||||
GLOBALS_OBJECTS_INCLUDE="yes"
|
||||
|
||||
# Mail setup
|
||||
# What would you like to be mailed to you?
|
||||
# - log : send only log file
|
||||
# - files : send log file and sql files as attachments (see docs)
|
||||
# - stdout : will simply output the log to the screen if run manually.
|
||||
# - quiet : Only send logs if an error occurs to the MAILADDR.
|
||||
MAILCONTENT="stdout"
|
||||
|
||||
# Set the maximum allowed email size in k. (4000 = approx 5MB email [see docs])
|
||||
MAXATTSIZE="4000"
|
||||
|
||||
# Email Address to send mail to? (user@domain.com)
|
||||
MAILADDR="user@domain.com"
|
||||
|
||||
# ============================================================
|
||||
# === ADVANCED OPTIONS ( Read the doc's below for details )===
|
||||
#=============================================================
|
||||
|
||||
# List of DBBNAMES for Monthly Backups.
|
||||
MDBNAMES="template1 $DBNAMES"
|
||||
|
||||
# List of DBNAMES to EXLUCDE if DBNAMES are set to all (must be in " quotes)
|
||||
DBEXCLUDE=""
|
||||
|
||||
# Include CREATE DATABASE in backup?
|
||||
CREATE_DATABASE=yes
|
||||
|
||||
# Separate backup directory and file for each DB? (yes or no)
|
||||
SEPDIR=yes
|
||||
|
||||
# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
|
||||
DOWEEKLY=6
|
||||
|
||||
# Choose Compression type. (gzip, bzip2 or xz)
|
||||
COMP=gzip
|
||||
|
||||
# Compress communications between backup server and PostgreSQL server?
|
||||
# set compression level from 0 to 9 (0 means no compression)
|
||||
COMMCOMP=0
|
||||
|
||||
# Additionally keep a copy of the most recent backup in a seperate directory.
|
||||
LATEST=no
|
||||
|
||||
# OPT string for use with pg_dump ( see man pg_dump )
|
||||
OPT=""
|
||||
|
||||
# Backup files extension
|
||||
EXT="sql"
|
||||
|
||||
# Backup files permissions
|
||||
PERM=600
|
||||
|
||||
# Encyrption settings
|
||||
# (inspired by http://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/)
|
||||
#
|
||||
# Once the backup done, each SQL dump will be encrypted and the original file
|
||||
# will be deleted (if encryption was successful).
|
||||
# It is recommended to backup into a staging directory, and then use the
|
||||
# POSTBACKUP script to sync the encrypted files to the desired location.
|
||||
#
|
||||
# Encryption uses private/public keys. You can generate the key pairs like the following:
|
||||
# openssl req -x509 -nodes -days 100000 -newkey rsa:2048 -keyout backup.key -out backup.crt -subj '/'
|
||||
#
|
||||
# Decryption:
|
||||
# openssl smime -decrypt -in backup.sql.gz.enc -binary -inform DEM -inkey backup.key -out backup.sql.gz
|
||||
|
||||
# Enable encryption
|
||||
ENCRYPTION=no
|
||||
|
||||
# Encryption public key
|
||||
ENCRYPTION_PUBLIC_KEY=""
|
||||
|
||||
# Encryption Cipher (see enc manpage)
|
||||
ENCRYPTION_CIPHER="aes256"
|
||||
|
||||
# Suffix for encyrpted files
|
||||
ENCRYPTION_SUFFIX=".enc"
|
||||
|
||||
# Command to run before backups (uncomment to use)
|
||||
#PREBACKUP="/etc/postgresql-backup-pre"
|
||||
|
||||
# Command run after backups (uncomment to use)
|
||||
#POSTBACKUP="/etc/postgresql-backup-post"
|
||||
|
||||
#=====================================================================
|
||||
# Debian specific options ===
|
||||
#=====================================================================
|
||||
|
||||
if [ -f /etc/default/autopostgresqlbackup ]; then
|
||||
. /etc/default/autopostgresqlbackup
|
||||
fi
|
||||
|
||||
#=====================================================================
|
||||
# Options documentation
|
||||
#=====================================================================
|
||||
# Set USERNAME and PASSWORD of a user that has at least SELECT permission
|
||||
# to ALL databases.
|
||||
#
|
||||
# Set the DBHOST option to the server you wish to backup, leave the
|
||||
# default to backup "this server".(to backup multiple servers make
|
||||
# copies of this file and set the options for that server)
|
||||
#
|
||||
# Put in the list of DBNAMES(Databases)to be backed up. If you would like
|
||||
# to backup ALL DBs on the server set DBNAMES="all".(if set to "all" then
|
||||
# any new DBs will automatically be backed up without needing to modify
|
||||
# this backup script when a new DB is created).
|
||||
#
|
||||
# If the DB you want to backup has a space in the name replace the space
|
||||
# with a % e.g. "data base" will become "data%base"
|
||||
# NOTE: Spaces in DB names may not work correctly when SEPDIR=no.
|
||||
#
|
||||
# You can change the backup storage location from /backups to anything
|
||||
# you like by using the BACKUPDIR setting..
|
||||
#
|
||||
# The MAILCONTENT and MAILADDR options and pretty self explanitory, use
|
||||
# these to have the backup log mailed to you at any email address or multiple
|
||||
# email addresses in a space seperated list.
|
||||
# (If you set mail content to "log" you will require access to the "mail" program
|
||||
# on your server. If you set this to "files" you will have to have mutt installed
|
||||
# on your server. If you set it to "stdout" it will log to the screen if run from
|
||||
# the console or to the cron job owner if run through cron. If you set it to "quiet"
|
||||
# logs will only be mailed if there are errors reported. )
|
||||
#
|
||||
# MAXATTSIZE sets the largest allowed email attachments total (all backup files) you
|
||||
# want the script to send. This is the size before it is encoded to be sent as an email
|
||||
# so if your mail server will allow a maximum mail size of 5MB I would suggest setting
|
||||
# MAXATTSIZE to be 25% smaller than that so a setting of 4000 would probably be fine.
|
||||
#
|
||||
# Finally copy autopostgresqlbackup.sh to anywhere on your server and make sure
|
||||
# to set executable permission. You can also copy the script to
|
||||
# /etc/cron.daily to have it execute automatically every night or simply
|
||||
# place a symlink in /etc/cron.daily to the file if you wish to keep it
|
||||
# somwhere else.
|
||||
# NOTE:On Debian copy the file with no extention for it to be run
|
||||
# by cron e.g just name the file "autopostgresqlbackup"
|
||||
#
|
||||
# Thats it..
|
||||
#
|
||||
#
|
||||
# === Advanced options doc's ===
|
||||
#
|
||||
# The list of MDBNAMES is the DB's to be backed up only monthly. You should
|
||||
# always include "template1" in this list to backup the default database
|
||||
# template used to create new databases.
|
||||
# NOTE: If DBNAMES="all" then MDBNAMES has no effect as all DBs will be backed
|
||||
# up anyway.
|
||||
#
|
||||
# If you set DBNAMES="all" you can configure the option DBEXCLUDE. Other
|
||||
# wise this option will not be used.
|
||||
# This option can be used if you want to backup all dbs, but you want
|
||||
# exclude some of them. (eg. a db is to big).
|
||||
#
|
||||
# Set CREATE_DATABASE to "yes" (the default) if you want your SQL-Dump to create
|
||||
# a database with the same name as the original database when restoring.
|
||||
# Saying "no" here will allow your to specify the database name you want to
|
||||
# restore your dump into, making a copy of the database by using the dump
|
||||
# created with autopostgresqlbackup.
|
||||
# NOTE: Not used if SEPDIR=no
|
||||
#
|
||||
# The SEPDIR option allows you to choose to have all DBs backed up to
|
||||
# a single file (fast restore of entire server in case of crash) or to
|
||||
# seperate directories for each DB (each DB can be restored seperately
|
||||
# in case of single DB corruption or loss).
|
||||
#
|
||||
# To set the day of the week that you would like the weekly backup to happen
|
||||
# set the DOWEEKLY setting, this can be a value from 1 to 7 where 1 is Monday,
|
||||
# The default is 6 which means that weekly backups are done on a Saturday.
|
||||
#
|
||||
# COMP is used to choose the copmression used, options are gzip or bzip2.
|
||||
# bzip2 will produce slightly smaller files but is more processor intensive so
|
||||
# may take longer to complete.
|
||||
#
|
||||
# COMMCOMP is used to set the compression level (from 0 to 9, 0 means no compression)
|
||||
# between the client and the server, so it is useful to save bandwidth when backing up
|
||||
# a remote PostgresSQL server over the network.
|
||||
#
|
||||
# LATEST is to store an additional copy of the latest backup to a standard
|
||||
# location so it can be downloaded bt thrid party scripts.
|
||||
#
|
||||
# Use PREBACKUP and POSTBACKUP to specify Per and Post backup commands
|
||||
# or scripts to perform tasks either before or after the backup process.
|
||||
#
|
||||
#
|
||||
#=====================================================================
|
||||
# Backup Rotation..
|
||||
#=====================================================================
|
||||
#
|
||||
# Daily Backups are rotated weekly..
|
||||
# Weekly Backups are run by default on Saturday Morning when
|
||||
# cron.daily scripts are run...Can be changed with DOWEEKLY setting..
|
||||
# Weekly Backups are rotated on a 5 week cycle..
|
||||
# Monthly Backups are run on the 1st of the month..
|
||||
# Monthly Backups are NOT rotated automatically...
|
||||
# It may be a good idea to copy Monthly backups offline or to another
|
||||
# server..
|
||||
#
|
||||
#=====================================================================
|
||||
# Please Note!!
|
||||
#=====================================================================
|
||||
#
|
||||
# I take no resposibility for any data loss or corruption when using
|
||||
# this script..
|
||||
# This script will not help in the event of a hard drive crash. If a
|
||||
# copy of the backup has not be stored offline or on another PC..
|
||||
# You should copy your backups offline regularly for best protection.
|
||||
#
|
||||
# Happy backing up...
|
||||
#
|
||||
#=====================================================================
|
||||
# Restoring
|
||||
#=====================================================================
|
||||
# Firstly you will need to uncompress the backup file.
|
||||
# eg.
|
||||
# gunzip file.gz (or bunzip2 file.bz2)
|
||||
#
|
||||
# Next you will need to use the postgresql client to restore the DB from the
|
||||
# sql file.
|
||||
# eg.
|
||||
# psql --host dbserver --dbname database < /path/file.sql
|
||||
#
|
||||
# NOTE: Make sure you use "<" and not ">" in the above command because
|
||||
# you are piping the file.sql to psql and not the other way around.
|
||||
#
|
||||
# Lets hope you never have to use this.. :)
|
||||
#
|
||||
#=====================================================================
|
||||
# Change Log
|
||||
#=====================================================================
|
||||
#
|
||||
# VER 1.0 - (2005-03-25)
|
||||
# Initial Release - based on AutoMySQLBackup 2.2
|
||||
#
|
||||
#=====================================================================
|
||||
#=====================================================================
|
||||
#=====================================================================
|
||||
#
|
||||
# Should not need to be modified from here down!!
|
||||
#
|
||||
#=====================================================================
|
||||
#=====================================================================
|
||||
#=====================================================================
|
||||
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/postgres/bin:/usr/local/pgsql/bin
|
||||
DATE=$(date +%Y-%m-%d_%Hh%Mm) # Datestamp e.g 2002-09-21
|
||||
DOW=$(date +%A) # Day of the week e.g. Monday
|
||||
DNOW=$(date +%u) # Day number of the week 1 to 7 where 1 represents Monday
|
||||
DOM=$(date +%d) # Date of the Month e.g. 27
|
||||
M=$(date +%B) # Month e.g January
|
||||
W=$(date +%V) # Week Number e.g 37
|
||||
VER=1.0 # Version Number
|
||||
LOGFILE=$BACKUPDIR/${DBHOST//\//_}-$(date +%N).log # Logfile Name
|
||||
LOGERR=$BACKUPDIR/ERRORS_${DBHOST//\//_}-$(date +%N).log # Logfile Name
|
||||
BACKUPFILES=""
|
||||
|
||||
# Add --compress pg_dump option to $OPT
|
||||
if [ "$COMMCOMP" -gt 0 ]; then
|
||||
OPT="$OPT --compress=$COMMCOMP"
|
||||
fi
|
||||
|
||||
# Create required directories
|
||||
if [ ! -e "$BACKUPDIR" ]; then # Check Backup Directory exists.
|
||||
mkdir -p "$BACKUPDIR"
|
||||
fi
|
||||
|
||||
if [ ! -e "$BACKUPDIR/daily" ]; then # Check Daily Directory exists.
|
||||
mkdir -p "$BACKUPDIR/daily"
|
||||
fi
|
||||
|
||||
if [ ! -e "$BACKUPDIR/weekly" ]; then # Check Weekly Directory exists.
|
||||
mkdir -p "$BACKUPDIR/weekly"
|
||||
fi
|
||||
|
||||
if [ ! -e "$BACKUPDIR/monthly" ]; then # Check Monthly Directory exists.
|
||||
mkdir -p "$BACKUPDIR/monthly"
|
||||
fi
|
||||
|
||||
if [ "$LATEST" = "yes" ]; then
|
||||
if [ ! -e "$BACKUPDIR/latest" ]; then # Check Latest Directory exists.
|
||||
mkdir -p "$BACKUPDIR/latest"
|
||||
fi
|
||||
rm -f "$BACKUPDIR"/latest/*
|
||||
fi
|
||||
|
||||
# IO redirection for logging.
|
||||
touch $LOGFILE
|
||||
exec 6>&1 # Link file descriptor #6 with stdout.
|
||||
# Saves stdout.
|
||||
exec >$LOGFILE # stdout replaced with file $LOGFILE.
|
||||
touch $LOGERR
|
||||
exec 7>&2 # Link file descriptor #7 with stderr.
|
||||
# Saves stderr.
|
||||
exec 2>$LOGERR # stderr replaced with file $LOGERR.
|
||||
|
||||
# Functions
|
||||
|
||||
# Database dump function
|
||||
dbdump() {
|
||||
rm -f $2
|
||||
touch $2
|
||||
chmod $PERM $2
|
||||
for db in $1; do
|
||||
if [ -n "$SU_USERNAME" ]; then
|
||||
if [ "$db" = "$GLOBALS_OBJECTS" ]; then
|
||||
su $SU_USERNAME -l -c "pg_dumpall $PGHOST --globals-only" >>$2
|
||||
else
|
||||
su $SU_USERNAME -l -c "pg_dump $PGHOST $OPT $db" >>$2
|
||||
fi
|
||||
else
|
||||
if [ "$db" = "$GLOBALS_OBJECTS" ]; then
|
||||
pg_dumpall --username=$USERNAME $PGHOST --globals-only >>$2
|
||||
else
|
||||
pg_dump --username=$USERNAME $PGHOST $OPT $db >>$2
|
||||
fi
|
||||
fi
|
||||
done
|
||||
return 0
|
||||
}
|
||||
|
||||
# Encryption function
|
||||
encryption() {
|
||||
ENCRYPTED_FILE="$1$ENCRYPTION_SUFFIX"
|
||||
# Encrypt as needed
|
||||
if [ "$ENCRYPTION" = "yes" ]; then
|
||||
echo
|
||||
echo "Encrypting $1"
|
||||
echo " to $ENCRYPTED_FILE"
|
||||
echo " using cypher $ENCRYPTION_CIPHER and public key $ENCRYPTION_PUBLIC_KEY"
|
||||
if openssl smime -encrypt -$ENCRYPTION_CIPHER -binary -outform DEM \
|
||||
-out "$ENCRYPTED_FILE" \
|
||||
-in "$1" "$ENCRYPTION_PUBLIC_KEY"; then
|
||||
echo " and remove $1"
|
||||
chmod $PERM "$ENCRYPTED_FILE"
|
||||
rm -f "$1"
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# Compression (and encrypt) function plus latest copy
|
||||
SUFFIX=""
|
||||
compression() {
|
||||
if [ "$COMP" = "gzip" ]; then
|
||||
gzip -f "$1"
|
||||
echo
|
||||
echo Backup Information for "$1"
|
||||
gzip -l "$1.gz"
|
||||
SUFFIX=".gz"
|
||||
elif [ "$COMP" = "bzip2" ]; then
|
||||
echo Compression information for "$1.bz2"
|
||||
bzip2 -f -v $1 2>&1
|
||||
SUFFIX=".bz2"
|
||||
elif [ "$COMP" = "xz" ]; then
|
||||
echo Compression information for "$1.xz"
|
||||
xz -9 -v $1 2>&1
|
||||
SUFFIX=".xz"
|
||||
else
|
||||
echo "No compression option set, check advanced settings"
|
||||
fi
|
||||
encryption $1$SUFFIX
|
||||
if [ "$LATEST" = "yes" ]; then
|
||||
cp $1$SUFFIX* "$BACKUPDIR/latest/"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# Run command before we begin
|
||||
if [ "$PREBACKUP" ]; then
|
||||
echo ======================================================================
|
||||
echo "Prebackup command output."
|
||||
echo
|
||||
$PREBACKUP
|
||||
echo
|
||||
echo ======================================================================
|
||||
echo
|
||||
fi
|
||||
|
||||
if [ "$SEPDIR" = "yes" ]; then # Check if CREATE DATABSE should be included in Dump
|
||||
if [ "$CREATE_DATABASE" = "no" ]; then
|
||||
OPT="$OPT"
|
||||
else
|
||||
OPT="$OPT --create"
|
||||
fi
|
||||
else
|
||||
OPT="$OPT"
|
||||
fi
|
||||
|
||||
# Hostname for LOG information
|
||||
if [ "$DBHOST" = "localhost" ]; then
|
||||
HOST=$(hostname)
|
||||
PGHOST=""
|
||||
else
|
||||
HOST=$DBHOST
|
||||
PGHOST="-h $DBHOST"
|
||||
fi
|
||||
|
||||
# If backing up all DBs on the server
|
||||
if [ "$DBNAMES" = "all" ]; then
|
||||
if [ -n "$SU_USERNAME" ]; then
|
||||
DBNAMES="$(su $SU_USERNAME -l -c "LANG=C psql -U $USERNAME $PGHOST -l -A -F: | sed -ne '/:/ { /Name:Owner/d; /template0/d; s/:.*$//; p }'")"
|
||||
else
|
||||
DBNAMES="$(LANG=C psql -U $USERNAME $PGHOST -l -A -F: | sed -ne "/:/ { /Name:Owner/d; /template0/d; s/:.*$//; p }")"
|
||||
fi
|
||||
|
||||
# If DBs are excluded
|
||||
for exclude in $DBEXCLUDE; do
|
||||
DBNAMES=$(echo $DBNAMES | sed "s/\b$exclude\b//g")
|
||||
done
|
||||
DBNAMES="$(echo $DBNAMES | tr '\n' ' ')"
|
||||
MDBNAMES=$DBNAMES
|
||||
fi
|
||||
|
||||
# Include global objects (users, tablespaces)
|
||||
if [ "$GLOBALS_OBJECTS_INCLUDE" = "yes" ]; then
|
||||
DBNAMES="$GLOBALS_OBJECTS $DBNAMES"
|
||||
MDBNAMES="$GLOBALS_OBJECTS $MDBNAMES"
|
||||
fi
|
||||
|
||||
echo ======================================================================
|
||||
echo AutoPostgreSQLBackup VER $VER
|
||||
echo http://autopgsqlbackup.frozenpc.net/
|
||||
echo
|
||||
echo Backup of Database Server - $HOST
|
||||
echo ======================================================================
|
||||
|
||||
# Test is seperate DB backups are required
|
||||
if [ "$SEPDIR" = "yes" ]; then
|
||||
echo Backup Start Time $(date)
|
||||
echo ======================================================================
|
||||
# Monthly Full Backup of all Databases
|
||||
if [ "$DOM" = "01" ]; then
|
||||
for MDB in $MDBNAMES; do
|
||||
|
||||
# Prepare $DB for using
|
||||
MDB="$(echo $MDB | sed 's/%/ /g')"
|
||||
|
||||
if [ ! -e "$BACKUPDIR/monthly/$MDB" ]; then # Check Monthly DB Directory exists.
|
||||
mkdir -p "$BACKUPDIR/monthly/$MDB"
|
||||
fi
|
||||
echo Monthly Backup of $MDB...
|
||||
dbdump "$MDB" "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.$EXT"
|
||||
compression "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
done
|
||||
fi
|
||||
|
||||
for DB in $DBNAMES; do
|
||||
# Prepare $DB for using
|
||||
DB="$(echo $DB | sed 's/%/ /g')"
|
||||
|
||||
# Create Seperate directory for each DB
|
||||
if [ ! -e "$BACKUPDIR/daily/$DB" ]; then # Check Daily DB Directory exists.
|
||||
mkdir -p "$BACKUPDIR/daily/$DB"
|
||||
fi
|
||||
|
||||
if [ ! -e "$BACKUPDIR/weekly/$DB" ]; then # Check Weekly DB Directory exists.
|
||||
mkdir -p "$BACKUPDIR/weekly/$DB"
|
||||
fi
|
||||
|
||||
# Weekly Backup
|
||||
if [ "$DNOW" = "$DOWEEKLY" ]; then
|
||||
echo Weekly Backup of Database \( $DB \)
|
||||
echo Rotating 5 weeks Backups...
|
||||
if [ "$W" -le 05 ]; then
|
||||
REMW=$(expr 48 + $W)
|
||||
elif [ "$W" -lt 15 ]; then
|
||||
REMW=0$(expr $W - 5)
|
||||
else
|
||||
REMW=$(expr $W - 5)
|
||||
fi
|
||||
rm -fv "$BACKUPDIR/weekly/$DB/${DB}_week.$REMW".*
|
||||
echo
|
||||
dbdump "$DB" "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.$EXT"
|
||||
compression "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
|
||||
# Daily Backup
|
||||
else
|
||||
echo Daily Backup of Database \( $DB \)
|
||||
echo Rotating last weeks Backup...
|
||||
rm -fv "$BACKUPDIR/daily/$DB"/*."$DOW".$EXT*
|
||||
echo
|
||||
dbdump "$DB" "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.$EXT"
|
||||
compression "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
fi
|
||||
done
|
||||
echo Backup End $(date)
|
||||
echo ======================================================================
|
||||
|
||||
else
|
||||
# One backup file for all DBs
|
||||
echo Backup Start $(date)
|
||||
echo ======================================================================
|
||||
# Monthly Full Backup of all Databases
|
||||
if [ "$DOM" = "01" ]; then
|
||||
echo Monthly full Backup of \( $MDBNAMES \)...
|
||||
dbdump "$MDBNAMES" "$BACKUPDIR/monthly/$DATE.$M.all-databases.$EXT"
|
||||
compression "$BACKUPDIR/monthly/$DATE.$M.all-databases.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$DATE.$M.all-databases.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
fi
|
||||
|
||||
# Weekly Backup
|
||||
if [ "$DNOW" = "$DOWEEKLY" ]; then
|
||||
echo Weekly Backup of Databases \( $DBNAMES \)
|
||||
echo
|
||||
echo Rotating 5 weeks Backups...
|
||||
if [ "$W" -le 05 ]; then
|
||||
REMW=$(expr 48 + $W)
|
||||
elif [ "$W" -lt 15 ]; then
|
||||
REMW=0$(expr $W - 5)
|
||||
else
|
||||
REMW=$(expr $W - 5)
|
||||
fi
|
||||
rm -fv "$BACKUPDIR/weekly/week.$REMW".*
|
||||
echo
|
||||
dbdump "$DBNAMES" "$BACKUPDIR/weekly/week.$W.$DATE.$EXT"
|
||||
compression "$BACKUPDIR/weekly/week.$W.$DATE.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/week.$W.$DATE.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
# Daily Backup
|
||||
else
|
||||
echo Daily Backup of Databases \( $DBNAMES \)
|
||||
echo
|
||||
echo Rotating last weeks Backup...
|
||||
rm -fv "$BACKUPDIR"/daily/*."$DOW".$EXT*
|
||||
echo
|
||||
dbdump "$DBNAMES" "$BACKUPDIR/daily/$DATE.$DOW.$EXT"
|
||||
compression "$BACKUPDIR/daily/$DATE.$DOW.$EXT"
|
||||
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DATE.$DOW.$EXT$SUFFIX*"
|
||||
echo ----------------------------------------------------------------------
|
||||
fi
|
||||
echo Backup End Time $(date)
|
||||
echo ======================================================================
|
||||
fi
|
||||
echo Total disk space used for backup storage..
|
||||
echo Size - Location
|
||||
echo $(du -hs "$BACKUPDIR")
|
||||
echo
|
||||
|
||||
# Run command when we're done
|
||||
if [ "$POSTBACKUP" ]; then
|
||||
echo ======================================================================
|
||||
echo "Postbackup command output."
|
||||
echo
|
||||
$POSTBACKUP
|
||||
echo
|
||||
echo ======================================================================
|
||||
fi
|
||||
|
||||
#Clean up IO redirection
|
||||
exec 1>&6 6>&- # Restore stdout and close file descriptor #6.
|
||||
exec 2>&7 7>&- # Restore stdout and close file descriptor #7.
|
||||
|
||||
if [ "$MAILCONTENT" = "files" ]; then
|
||||
if [ -s "$LOGERR" ]; then
|
||||
# Include error log if is larger than zero.
|
||||
BACKUPFILES="$BACKUPFILES $LOGERR"
|
||||
ERRORNOTE="WARNING: Error Reported - "
|
||||
fi
|
||||
#Get backup size
|
||||
ATTSIZE=$(du -c $BACKUPFILES | grep "[[:digit:][:space:]]total$" | sed s/\s*total//)
|
||||
if [ $MAXATTSIZE -ge $ATTSIZE ]; then
|
||||
if which biabam >/dev/null 2>&1; then
|
||||
BACKUPFILES=$(echo $BACKUPFILES | sed -r -e 's#\s+#,#g')
|
||||
biabam -s "PostgreSQL Backup Log and SQL Files for $HOST - $DATE" $BACKUPFILES $MAILADDR <$LOGFILE
|
||||
elif which heirloom-mailx >/dev/null 2>&1; then
|
||||
BACKUPFILES=$(echo $BACKUPFILES | sed -e 's# # -a #g')
|
||||
heirloom-mailx -s "PostgreSQL Backup Log and SQL Files for $HOST - $DATE" $BACKUPFILES $MAILADDR <$LOGFILE
|
||||
elif which neomutt >/dev/null 2>&1; then
|
||||
BACKUPFILES=$(echo $BACKUPFILES | sed -e 's# # -a #g')
|
||||
neomutt -s "PostgreSQL Backup Log and SQL Files for $HOST - $DATE" -a $BACKUPFILES -- $MAILADDR <$LOGFILE
|
||||
elif which mutt >/dev/null 2>&1; then
|
||||
BACKUPFILES=$(echo $BACKUPFILES | sed -e 's# # -a #g')
|
||||
mutt -s "PostgreSQL Backup Log and SQL Files for $HOST - $DATE" -a $BACKUPFILES -- $MAILADDR <$LOGFILE
|
||||
else
|
||||
cat "$LOGFILE" | mail -s "WARNING! - Enable to send PostgreSQL Backup dumps, no suitable mail client found on $HOST - $DATE" $MAILADDR
|
||||
fi
|
||||
else
|
||||
cat "$LOGFILE" | mail -s "WARNING! - PostgreSQL Backup exceeds set maximum attachment size on $HOST - $DATE" $MAILADDR
|
||||
fi
|
||||
elif [ "$MAILCONTENT" = "log" ]; then
|
||||
cat "$LOGFILE" | mail -s "PostgreSQL Backup Log for $HOST - $DATE" $MAILADDR
|
||||
if [ -s "$LOGERR" ]; then
|
||||
cat "$LOGERR" | mail -s "ERRORS REPORTED: PostgreSQL Backup error Log for $HOST - $DATE" $MAILADDR
|
||||
fi
|
||||
elif [ "$MAILCONTENT" = "quiet" ]; then
|
||||
if [ -s "$LOGERR" ]; then
|
||||
cat "$LOGERR" | mail -s "ERRORS REPORTED: PostgreSQL Backup error Log for $HOST - $DATE" $MAILADDR
|
||||
cat "$LOGFILE" | mail -s "PostgreSQL Backup Log for $HOST - $DATE" $MAILADDR
|
||||
fi
|
||||
else
|
||||
if [ -s "$LOGERR" ]; then
|
||||
cat "$LOGFILE"
|
||||
echo
|
||||
echo "###### WARNING ######"
|
||||
echo "Errors reported during AutoPostgreSQLBackup execution.. Backup failed"
|
||||
echo "Error log below.."
|
||||
cat "$LOGERR"
|
||||
else
|
||||
cat "$LOGFILE"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -s "$LOGERR" ]; then
|
||||
STATUS=1
|
||||
else
|
||||
STATUS=0
|
||||
fi
|
||||
|
||||
# Clean up Logfile
|
||||
rm -f "$LOGFILE"
|
||||
rm -f "$LOGERR"
|
||||
|
||||
exit $STATUS
|
||||
@@ -0,0 +1,162 @@
|
||||
[flags]
|
||||
# Whether to hide the average cpu entry.
|
||||
#hide_avg_cpu = false
|
||||
# Whether to use dot markers rather than braille.
|
||||
#dot_marker = false
|
||||
# The update rate of the application.
|
||||
#rate = 1000
|
||||
# Whether to put the CPU legend to the left.
|
||||
#left_legend = false
|
||||
# Whether to set CPU% on a process to be based on the total CPU or just current usage.
|
||||
#current_usage = false
|
||||
# Whether to group processes with the same name together by default.
|
||||
#group_processes = false
|
||||
# Whether to make process searching case sensitive by default.
|
||||
#case_sensitive = false
|
||||
# Whether to make process searching look for matching the entire word by default.
|
||||
#whole_word = false
|
||||
# Whether to make process searching use regex by default.
|
||||
#regex = false
|
||||
# Defaults to Celsius. Temperature is one of:
|
||||
#temperature_type = "k"
|
||||
#temperature_type = "f"
|
||||
#temperature_type = "c"
|
||||
#temperature_type = "kelvin"
|
||||
#temperature_type = "fahrenheit"
|
||||
#temperature_type = "celsius"
|
||||
# The default time interval (in milliseconds).
|
||||
#default_time_value = 60000
|
||||
# The time delta on each zoom in/out action (in milliseconds).
|
||||
#time_delta = 15000
|
||||
# Hides the time scale.
|
||||
#hide_time = false
|
||||
# Override layout default widget
|
||||
#default_widget_type = "proc"
|
||||
#default_widget_count = 1
|
||||
# Use basic mode
|
||||
#basic = false
|
||||
# Use the old network legend style
|
||||
#use_old_network_legend = false
|
||||
# Remove space in tables
|
||||
#hide_table_gap = false
|
||||
# Show the battery widgets
|
||||
#battery = false
|
||||
# Disable mouse clicks
|
||||
#disable_click = false
|
||||
# Built-in themes. Valid values are "default", "default-light", "gruvbox", "gruvbox-light", "nord", "nord-light"
|
||||
#color = "default"
|
||||
# Show memory values in the processes widget as values by default
|
||||
#mem_as_value = false
|
||||
# Show tree mode by default in the processes widget.
|
||||
#tree = false
|
||||
# Shows an indicator in table widgets tracking where in the list you are.
|
||||
#show_table_scroll_position = false
|
||||
# Show processes as their commands by default in the process widget.
|
||||
#process_command = false
|
||||
# Displays the network widget with binary prefixes.
|
||||
#network_use_binary_prefix = false
|
||||
# Displays the network widget using bytes.
|
||||
network_use_bytes = true
|
||||
# Displays the network widget with a log scale.
|
||||
#network_use_log = false
|
||||
# Hides advanced options to stop a process on Unix-like systems.
|
||||
#disable_advanced_kill = false
|
||||
|
||||
# These are all the components that support custom theming. Note that colour support
|
||||
# will depend on terminal support.
|
||||
|
||||
#[colors] # Uncomment if you want to use custom colors
|
||||
# Represents the colour of table headers (processes, CPU, disks, temperature).
|
||||
#table_header_color="LightBlue"
|
||||
# Represents the colour of the label each widget has.
|
||||
#widget_title_color="Gray"
|
||||
# Represents the average CPU color.
|
||||
#avg_cpu_color="Red"
|
||||
# Represents the colour the core will use in the CPU legend and graph.
|
||||
#cpu_core_colors=["LightMagenta", "LightYellow", "LightCyan", "LightGreen", "LightBlue", "LightRed", "Cyan", "Green", "Blue", "Red"]
|
||||
# Represents the colour RAM will use in the memory legend and graph.
|
||||
#ram_color="LightMagenta"
|
||||
# Represents the colour SWAP will use in the memory legend and graph.
|
||||
#swap_color="LightYellow"
|
||||
# Represents the colour rx will use in the network legend and graph.
|
||||
#rx_color="LightCyan"
|
||||
# Represents the colour tx will use in the network legend and graph.
|
||||
#tx_color="LightGreen"
|
||||
# Represents the colour of the border of unselected widgets.
|
||||
#border_color="Gray"
|
||||
# Represents the colour of the border of selected widgets.
|
||||
#highlighted_border_color="LightBlue"
|
||||
# Represents the colour of most text.
|
||||
#text_color="Gray"
|
||||
# Represents the colour of text that is selected.
|
||||
#selected_text_color="Black"
|
||||
# Represents the background colour of text that is selected.
|
||||
#selected_bg_color="LightBlue"
|
||||
# Represents the colour of the lines and text of the graph.
|
||||
#graph_color="Gray"
|
||||
# Represents the colours of the battery based on charge
|
||||
#high_battery_color="green"
|
||||
#medium_battery_color="yellow"
|
||||
#low_battery_color="red"
|
||||
|
||||
# Layout - layouts follow a pattern like this:
|
||||
# [[row]] represents a row in the application.
|
||||
# [[row.child]] represents either a widget or a column.
|
||||
# [[row.child.child]] represents a widget.
|
||||
#
|
||||
# All widgets must have the type value set to one of ["cpu", "mem", "proc", "net", "temp", "disk", "empty"].
|
||||
# All layout components have a ratio value - if this is not set, then it defaults to 1.
|
||||
# The default widget layout:
|
||||
[[row]]
|
||||
ratio=30
|
||||
[[row.child]]
|
||||
type="cpu"
|
||||
|
||||
[[row]]
|
||||
ratio=40
|
||||
[[row.child]]
|
||||
ratio=4
|
||||
type="mem"
|
||||
[[row.child]]
|
||||
ratio=3
|
||||
[[row.child.child]]
|
||||
type="disk"
|
||||
|
||||
[[row]]
|
||||
ratio=30
|
||||
[[row.child]]
|
||||
type="net"
|
||||
[[row.child]]
|
||||
type="proc"
|
||||
default=true
|
||||
|
||||
|
||||
# Filters - you can hide specific temperature sensors, network interfaces, and disks using filters. This is admittedly
|
||||
# a bit hard to use as of now, and there is a planned in-app interface for managing this in the future:
|
||||
[disk_filter]
|
||||
is_list_ignored = true
|
||||
list = ["/dev/loop\\d+"]
|
||||
regex = true
|
||||
case_sensitive = false
|
||||
whole_word = false
|
||||
|
||||
#[mount_filter]
|
||||
#is_list_ignored = true
|
||||
#list = ["/mnt/.*", "/boot"]
|
||||
#regex = true
|
||||
#case_sensitive = false
|
||||
#whole_word = false
|
||||
|
||||
#[temp_filter]
|
||||
#is_list_ignored = true
|
||||
#list = ["cpu", "wifi"]
|
||||
#regex = false
|
||||
#case_sensitive = false
|
||||
#whole_word = false
|
||||
|
||||
#[net_filter]
|
||||
#is_list_ignored = true
|
||||
#list = ["virbr0.*"]
|
||||
#regex = true
|
||||
#case_sensitive = false
|
||||
#whole_word = false
|
||||
@@ -0,0 +1,14 @@
|
||||
Port 22
|
||||
AddressFamily inet
|
||||
|
||||
AllowUsers {{ env.USERS }}
|
||||
|
||||
AcceptEnv LANG LC_*
|
||||
Subsystem sftp internal-sftp
|
||||
UsePAM yes
|
||||
PasswordAuthentication no
|
||||
PermitRootLogin no
|
||||
PrintLastLog no
|
||||
PrintMotd no
|
||||
ChallengeResponseAuthentication no
|
||||
X11Forwarding no
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
containers:
|
||||
dmz: [dmz]
|
||||
ct1: [mariadb, postgresql]
|
||||
credential:
|
||||
username: {{env.current_user}}
|
||||
shadow: {{env.shadow_passwd}}
|
||||
email: TO BE DEFINED # example user@domain.tld
|
||||
password: TO BE DEFINED
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
---
|
||||
services: []
|
||||
containers: []
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
containers:
|
||||
ct2: [ dokuwiki, dolibarr13 ]
|
||||
services:
|
||||
artcode.re:
|
||||
compta:
|
||||
app: dolibarr13
|
||||
port: 9001
|
||||
name: doli-artcode
|
||||
enabled: false
|
||||
pnrun.re:
|
||||
wiki:
|
||||
app: dokuwiki
|
||||
port: 80
|
||||
name: doku-pnrun
|
||||
enabled: false
|
||||
original:
|
||||
app: dokuwiki
|
||||
port: 8001
|
||||
name: doku-first
|
||||
enabled: false
|
||||
comptoirduvrac.re:
|
||||
gestion:
|
||||
app: odoo12
|
||||
port: 6003
|
||||
name: cdv
|
||||
@@ -0,0 +1,23 @@
|
||||
table inet firewall {
|
||||
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
|
||||
# established/related connections
|
||||
ct state established,related accept
|
||||
|
||||
# loopback + lxdbr0 interface
|
||||
iifname lo accept
|
||||
iifname lxdbr0 accept
|
||||
|
||||
# icmp
|
||||
icmp type echo-request accept
|
||||
|
||||
# allow mDNS
|
||||
udp dport mdns accept
|
||||
|
||||
# allow SSH + GITEA + NGINX
|
||||
tcp dport {22, 2222, 80, 443} accept
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
|
||||
authorized:
|
||||
pubkey: TO_BE_DEFINED
|
||||
|
||||
alert:
|
||||
to: TO_BE_DEFINED # example: mine@domain.tld
|
||||
from: TO_BE_DEFINED # example: no-reply@domain.tld
|
||||
smtp:
|
||||
server: TO_BE_DEFINED # example: mail.domain.tld
|
||||
username: TO_BE_DEFINED # example: postmaster@domain.tld
|
||||
password: TO_BE_DEFINED
|
||||
|
||||
timezone: # optional, example: UTC, Indian/Reunion, ...
|
||||
@@ -0,0 +1,2 @@
|
||||
{{ env.current_user }}: root
|
||||
root: {{ alert.to }}
|
||||
@@ -0,0 +1,6 @@
|
||||
set ask askcc append dot save crt
|
||||
#ignore Received Message-Id Resent-Message-Id Status Mail-From Return-Path Via Delivered-To
|
||||
set mta=/usr/bin/msmtp
|
||||
|
||||
alias {{ env.current_user }} root
|
||||
alias root {{ alert.to }}
|
||||
@@ -0,0 +1,26 @@
|
||||
# Set default values for all following accounts.
|
||||
defaults
|
||||
|
||||
# Use the mail submission port 587 instead of the SMTP port 25.
|
||||
port 587
|
||||
|
||||
# Always use TLS.
|
||||
tls on
|
||||
|
||||
# Set a list of trusted CAs for TLS. The default is to use system settings, but
|
||||
# you can select your own file.
|
||||
tls_trust_file /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
# The SMTP server of your ISP
|
||||
account alert
|
||||
host {{ alert.smtp.server }}
|
||||
from {{ env.fqdn }} <{{ alert.from }}>
|
||||
auth on
|
||||
user {{ alert.smtp.username }}
|
||||
password {{ alert.smtp.password }}
|
||||
|
||||
# Set default account to isp
|
||||
account default: alert
|
||||
|
||||
# Map local users to mail addresses
|
||||
aliases /etc/aliases
|
||||
@@ -0,0 +1,31 @@
|
||||
#!/bin/bash
|
||||
|
||||
hostname=$(hostname -s)
|
||||
number=$(echo $hostname | grep -oP '[0-9]*$')
|
||||
hostname=${hostname%"$number"}
|
||||
rows=9
|
||||
|
||||
case $hostname in
|
||||
'prod')
|
||||
#print in RED
|
||||
echo -ne "\033[31;1m"
|
||||
;;
|
||||
'beta')
|
||||
rows=7
|
||||
#print in ORANGE
|
||||
echo -ne "\033[33;1m"
|
||||
;;
|
||||
'dev')
|
||||
rows=7
|
||||
#print in GREEN
|
||||
echo -ne "\033[33;1m"
|
||||
;;
|
||||
*)
|
||||
#print in GREEN
|
||||
echo -ne "\033[32;1m"
|
||||
;;
|
||||
esac
|
||||
|
||||
fullname="$hostname $number"
|
||||
figlet -f big "$fullname" | head -n$rows
|
||||
echo -ne "\033[0m"
|
||||
@@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
FQDN=$(hostname --fqdn)
|
||||
IP_ADDRESS=$(hostname -I | cut -d ' ' -f1)
|
||||
DISTRO=$(lsb_release -d | cut -f2)
|
||||
KERNEL=$(uname -srm)
|
||||
UPTIME=$(uptime | awk -F'( |,|:)+' '{if ($7=="min") m=$6; else {if ($7~/^day/) {d=$6;h=$8;m=$9} else {h=$6;m=$7}}} {print d+0,"days"}')
|
||||
LOAD=$(cat /proc/loadavg)
|
||||
|
||||
echo "FQDN : $FQDN"
|
||||
echo "UPTIME: $UPTIME"
|
||||
echo "IPADDR: $IP_ADDRESS"
|
||||
echo "DISTRO: $DISTRO"
|
||||
echo "KERNEL: $KERNEL"
|
||||
echo "LOAD : $LOAD"
|
||||
@@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
USERS=$(
|
||||
w -uh
|
||||
)
|
||||
|
||||
if [ -n "$USERS" ]; then
|
||||
echo '-----------------------------------------------'
|
||||
echo -e "${RED}Beware,${NC} there is another connected user${RED}"
|
||||
echo "$USERS"
|
||||
echo -e "${NC}-----------------------------------------------"
|
||||
fi
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/usr/sbin/nft -f
|
||||
|
||||
flush ruleset
|
||||
|
||||
include "/etc/nftables.rules.d/*"
|
||||
@@ -0,0 +1,17 @@
|
||||
#!/bin/bash
|
||||
|
||||
[[ "$PAM_TYPE" != "open_session" ]] && exit 0
|
||||
|
||||
if journalctl --since "1 minute ago" -u ssh | tac | grep Accepted -m1 | grep password; then
|
||||
{
|
||||
echo "User: $PAM_USER"
|
||||
echo "Remote Host: $PAM_RHOST"
|
||||
echo "Service: $PAM_SERVICE"
|
||||
echo "TTY: $PAM_TTY"
|
||||
echo "Date: $(date)"
|
||||
echo "Server: $(uname -a)"
|
||||
echo
|
||||
echo "Somebody has successfully logged in your machine, please be aware and acknowledge this event."
|
||||
} | mail -s "$PAM_SERVICE login on $(hostname -f) for account $PAM_USER" root
|
||||
fi
|
||||
exit 0
|
||||
@@ -0,0 +1,16 @@
|
||||
Port 2222
|
||||
AllowUsers {{env.current_user}}
|
||||
|
||||
AcceptEnv LANG LC_*
|
||||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||||
ClientAliveInterval 120
|
||||
UsePAM yes
|
||||
MaxAuthTries 3
|
||||
|
||||
PasswordAuthentication no
|
||||
PermitRootLogin no
|
||||
PermitEmptyPasswords no
|
||||
PrintLastLog no
|
||||
PrintMotd no
|
||||
ChallengeResponseAuthentication no
|
||||
X11Forwarding no
|
||||
@@ -0,0 +1,6 @@
|
||||
Defaults env_reset
|
||||
Defaults mail_badpass
|
||||
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/TOOLBOX"
|
||||
|
||||
User_Alias ROOT = root, {{env.current_user}}
|
||||
ROOT ALL=(ALL:ALL) NOPASSWD: ALL
|
||||
@@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=Startup Script
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStartPre=/bin/sleep 10
|
||||
ExecStart=/bin/bash -c "last -wad | mail -s 'server has been rebooted' root"
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,7 @@
|
||||
{% for container in expanded.monitored.containers -%}
|
||||
check program {{ container }}.running
|
||||
with path "/root/lxc-is-running {{ container }}"
|
||||
depends on bridge
|
||||
if status != 0 then alert
|
||||
|
||||
{% endfor -%}
|
||||
@@ -0,0 +1,6 @@
|
||||
{% for host in expanded.monitored.hosts -%}
|
||||
check host {{ host.container }}.{{ host.port }} with address {{ host.container }}.lxd
|
||||
depends on {{ host.container }}.running
|
||||
if failed port {{ host.port }} protocol http for 2 cycles then alert
|
||||
|
||||
{% endfor -%}
|
||||
Executable
+27
@@ -0,0 +1,27 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [[ "$2" == "up" ]]; then
|
||||
|
||||
ACTIVE_CONNECTION=$(nmcli -g NAME connection show --active | head -n1)
|
||||
ACTIVE_DEVICE=$(nmcli -g DEVICE connection show --active | head -n1)
|
||||
BRIDGE=$(ip addr show lxdbr0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)
|
||||
GATEWAY=$(ip route | head -n1 | grep default | cut -d' ' -f3)
|
||||
logger -t NetworkManager:Dispatcher -p info "on $ACTIVE_DEVICE:$ACTIVE_CONNECTION up , change resolver to $BRIDGE,$GATEWAY"
|
||||
nmcli device modify "$ACTIVE_DEVICE" ipv4.dns "$BRIDGE,$GATEWAY"
|
||||
|
||||
if ! grep nameserver /etc/resolv.conf | head -n1 | grep -q "$BRIDGE"; then
|
||||
# sometimes, nmcli generates wrong order for namespace in resolv.conf, therefore forcing connection settings must be applied!
|
||||
logger -t NetworkManager:Dispatcher -p info "on $ACTIVE_DEVICE:$ACTIVE_CONNECTION nameservers wrong order detected, therefore forcing connection settings must be applied"
|
||||
nmcli connection modify "$ACTIVE_CONNECTION" ipv4.ignore-auto-dns yes
|
||||
nmcli connection modify "$ACTIVE_CONNECTION" ipv4.dns "$BRIDGE,$GATEWAY"
|
||||
logger -t NetworkManager:Dispatcher -p info "on $ACTIVE_DEVICE:$ACTIVE_CONNECTION nameservers wrong order detected, connection reloaded now!"
|
||||
nmcli connection up "$ACTIVE_CONNECTION"
|
||||
else
|
||||
logger -t NetworkManager:Dispatcher -p info "on $ACTIVE_DEVICE:$ACTIVE_CONNECTION nameservers look fine"
|
||||
fi
|
||||
else
|
||||
if [[ "$2" == "connectivity-change" ]]; then
|
||||
ACTIVE_DEVICE=$(nmcli -g DEVICE connection show --active | head -n1)
|
||||
logger -t NetworkManager:Dispatcher -p info "on $ACTIVE_DEVICE connectivity-change detected"
|
||||
fi
|
||||
fi
|
||||
@@ -0,0 +1,35 @@
|
||||
table inet lxd {
|
||||
chain pstrt.lxdbr0 {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
{%- if target != 'prod' %}
|
||||
# BLOCK SMTP PORTS
|
||||
tcp dport { 25, 465, 587 } ip saddr {{ firewall.bridge_subnet }} {%- if firewall.container_mail_passthrough %} ip saddr
|
||||
!= {{ env.ip_mail_passthrough }} {% endif %} log prefix "Drop SMTP away from container: " drop
|
||||
{% endif -%}
|
||||
|
||||
ip saddr {{ firewall.bridge_subnet }} ip daddr != {{ firewall.bridge_subnet }} masquerade
|
||||
}
|
||||
|
||||
chain fwd.lxdbr0 {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
ip version 4 oifname "lxdbr0" accept
|
||||
ip version 4 iifname "lxdbr0" accept
|
||||
}
|
||||
|
||||
chain in.lxdbr0 {
|
||||
type filter hook input priority filter; policy accept;
|
||||
iifname "lxdbr0" tcp dport 53 accept
|
||||
iifname "lxdbr0" udp dport 53 accept
|
||||
iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
|
||||
iifname "lxdbr0" udp dport 67 accept
|
||||
}
|
||||
|
||||
chain out.lxdbr0 {
|
||||
type filter hook output priority filter; policy accept;
|
||||
oifname "lxdbr0" tcp sport 53 accept
|
||||
oifname "lxdbr0" udp sport 53 accept
|
||||
oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
|
||||
oifname "lxdbr0" udp sport 67 accept
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
table ip nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
iif "{{ nftables.wan_interface }}" tcp dport { 80, 443 } dnat to {{ nftables.dmz_ip }}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
# DEFAULT SERVER
|
||||
|
||||
# redirect any http request to https
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# respond dummy nginx page
|
||||
server {
|
||||
listen 443 default_server ssl;
|
||||
include snippets/snakeoil.conf;
|
||||
root /var/www/html;
|
||||
index index.html index.htm index.nginx-debian.html;
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{% for service in expanded.services %}
|
||||
server {
|
||||
listen 443 http2 ssl;
|
||||
server_name {{ service.fqdn }};
|
||||
|
||||
{%- if target == 'dev' %}
|
||||
include snippets/snakeoil.conf;
|
||||
{%- else %}
|
||||
ssl_certificate /etc/letsencrypt/live/{{ service.domain }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ service.domain }}/privkey.pem;
|
||||
{%- endif %}
|
||||
|
||||
location / {
|
||||
proxy_pass http://{{ service.container }}:{{ service.port }};
|
||||
{%- if service.app == 'odoo15' %}
|
||||
client_max_body_size 5M;
|
||||
{%- endif %}
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
{%- if target != 'prod' %}
|
||||
include snippets/banner_{{ target }}.conf;
|
||||
{%- endif %}
|
||||
}
|
||||
|
||||
{%- if service.app == 'odoo15' or service.app == 'odoo12' %}
|
||||
location /longpolling {
|
||||
proxy_pass http://{{ service.container }}:{{ service.port + 1000 }};
|
||||
}
|
||||
{%- endif %}
|
||||
}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,67 @@
|
||||
proxy_set_header Accept-Encoding "";
|
||||
|
||||
subs_filter '</body>' '
|
||||
<div class="betabanner_box">
|
||||
<div class="betabanner_ribbon"><span>BETA</span></div>
|
||||
</div>
|
||||
|
||||
<style>
|
||||
|
||||
.betabanner_box {
|
||||
height: 100%;
|
||||
position: absolute;
|
||||
bottom: 0;
|
||||
pointer-events: none;
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
.betabanner_ribbon {
|
||||
position: fixed;
|
||||
left: -5px;
|
||||
bottom : 0;
|
||||
z-index: 9999;
|
||||
overflow: hidden;
|
||||
width: 75px; height: 75px;
|
||||
text-align: right;
|
||||
}
|
||||
.betabanner_ribbon span {
|
||||
font-size: 10px;
|
||||
font-weight: bold;
|
||||
color: #FFF;
|
||||
text-transform: uppercase;
|
||||
text-align: center;
|
||||
line-height: 20px;
|
||||
transform: rotate(45deg);
|
||||
-webkit-transform: rotate(45deg);
|
||||
width: 100px;
|
||||
display: block;
|
||||
background: #79A70A;
|
||||
|
||||
background: linear-gradient(#ABC900 30%, #79A70A 61%);
|
||||
box-shadow: 5px 9px 27px -4px rgba(0, 0, 0, 1);
|
||||
|
||||
position: absolute;
|
||||
bottom: 16px;
|
||||
left: -21px;
|
||||
}
|
||||
.betabanner_ribbon span::before {
|
||||
content: "";
|
||||
position: absolute; left: 0px; top: 100%;
|
||||
z-index: -1;
|
||||
border-left: 3px solid #79A70A;
|
||||
border-right: 3px solid transparent;
|
||||
border-bottom: 3px solid transparent;
|
||||
border-top: 3px solid #79A70A;
|
||||
}
|
||||
.betabanner_ribbon span::after {
|
||||
content: "";
|
||||
position: absolute; right: 0px; top: 100%;
|
||||
z-index: -1;
|
||||
border-left: 3px solid transparent;
|
||||
border-right: 3px solid #79A70A;
|
||||
border-bottom: 3px solid transparent;
|
||||
border-top: 3px solid #79A70A;
|
||||
}
|
||||
</style>
|
||||
</body>
|
||||
';
|
||||
@@ -0,0 +1,65 @@
|
||||
proxy_set_header Accept-Encoding "";
|
||||
|
||||
subs_filter '</body>' '
|
||||
<div class="betabanner_box">
|
||||
<div class="betabanner_ribbon"><span>DEV</span></div>
|
||||
</div>
|
||||
|
||||
<style>
|
||||
|
||||
.betabanner_box {
|
||||
height: 100%;
|
||||
position: absolute;
|
||||
bottom: 0;
|
||||
pointer-events: none;
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
.betabanner_ribbon {
|
||||
position: fixed;
|
||||
left: -5px;
|
||||
bottom : 0;
|
||||
z-index: 9999;
|
||||
overflow: hidden;
|
||||
width: 75px; height: 75px;
|
||||
text-align: right;
|
||||
}
|
||||
.betabanner_ribbon span {
|
||||
font-size: 10px;
|
||||
font-weight: bold;
|
||||
color: #FFF;
|
||||
text-transform: uppercase;
|
||||
text-align: center;
|
||||
line-height: 20px;
|
||||
transform: rotate(45deg);
|
||||
-webkit-transform: rotate(45deg);
|
||||
width: 100px;
|
||||
display: block;
|
||||
background: linear-gradient(lightblue 30%, blue 81%);
|
||||
box-shadow: 5px 9px 27px -4px rgba(0, 0, 0, 1);
|
||||
|
||||
position: absolute;
|
||||
bottom: 16px;
|
||||
left: -21px;
|
||||
}
|
||||
.betabanner_ribbon span::before {
|
||||
content: "";
|
||||
position: absolute; left: 0px; top: 100%;
|
||||
z-index: -1;
|
||||
border-left: 3px solid #79A70A;
|
||||
border-right: 3px solid transparent;
|
||||
border-bottom: 3px solid transparent;
|
||||
border-top: 3px solid #79A70A;
|
||||
}
|
||||
.betabanner_ribbon span::after {
|
||||
content: "";
|
||||
position: absolute; right: 0px; top: 100%;
|
||||
z-index: -1;
|
||||
border-left: 3px solid transparent;
|
||||
border-right: 3px solid #79A70A;
|
||||
border-bottom: 3px solid transparent;
|
||||
border-top: 3px solid #79A70A;
|
||||
}
|
||||
</style>
|
||||
</body>
|
||||
';
|
||||
Reference in New Issue
Block a user