You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

440 lines
8.6 KiB

#!/bin/bash
set -eux # -x for verbose logging to juju debug-log
apt-get update
apt-get -y install bash-completion wget bzip2 git-core less language-pack-en python-software-properties tmux mosh sudo git
## 0k git remote path
GIT_0K_BASE=${GIT_0K_BASE:-"git.0k.io:/var/git"}
## 0k git remote options
GIT_0K_CLONE_OPTIONS=${GIT_0K_CLONE_OPTIONS:-""}
#BTRFS_DEVICE=
BTRFS_MOUNT_ROOT=${BTRFS_MOUNT_ROOT:-"/mnt/btrfs-root"}
if [ -z "$BTRFS_DEVICE" ]; then
echo "You must set a BTRFS_DEVICE environement variable prior to executing this hook."
exit 1
fi
MAIL_NAME=${MAIL_NAME:-localhost}
MAIL_DOMAINNAME=${MAIL_DOMAINNAME:-"localdomain"}
MAIL_SATTELITE_RELAYHOST=${MAIL_SATTELITE_RELAYHOST:-}
##
## etckeeper
##
apt-get install etckeeper
sed -i 's/#VCS="git"/VCS="git"/g' /etc/etckeeper/etckeeper.conf
sed -i 's/VCS="bzr"/#VCS="bzr"/g' /etc/etckeeper/etckeeper.conf
etckeeper init
##
## Git utilities
##
echo "[alias]
co = checkout
com = commit
st = status
ci = commit
[color]
branch = auto
diff = auto
interactive = auto
status = auto
" >> /etc/gitconfig
##
## kal-scripts
##
cat <<EOF >> /etc/apt/sources.list
## vlab's shell libraries
deb http://deb.kalysto.org no-dist kal-alpha kal-beta kal-main
EOF
apt-get update
apt-get install -y --force-yes kal-scripts python-pip &&
pip install shyaml
##
## More shell configurations (prompt, functions)
##
mkdir -p /etc/prompt
cat <<EOF > /etc/prompt/prompt.1.rc
PROMPT_COMMAND=""
parse_git_branch() {
ref=\$(git symbolic-ref HEAD 2> /dev/null) || return
echo -en ' (\033[0;32m'\${ref#refs/heads/}'\033[0m)'
}
export PS1="\[\033[0;37m\][\[\033[1;30m\]\u\[\033[0;37m\]@\[\033[1;30m\]\h\[\033[0;37m\]]-[\[\033[1;34m\]\w\[\033[0;37m\]]\\\$(parse_git_branch)\n\[\033[1;37m\]\\$ \[\033[0;37m\]"
EOF
cat <<EOF >> /root/.bashrc
## History management
export HISTCONTROL=ignoredups
export HISTSIZE=50000
shopt -s histappend
PROMPT_COMMAND='history -a'
## Prompt easy management
prompt() {
prompt_name="prompt.\$1.rc"
for i in /etc/prompt ~/.prompt; do
[ -f "\$i/\$prompt_name" ] &&
. "\$i/\$prompt_name"
done
}
## Git log command
function glog() {
git log --graph --pretty=tformat:%C\(yellow\ normal\)%h%Creset\ %C\(blue\ normal\)%an%Creset\ %s\ %Cgreen%d%Creset -n 20 "\$@"
}
prompt 1
EOF
##
## btrfs install
##
apt-get install -y btrfs-tools
echo "the following is dangerous code. Please execute yourself for now."
exit 1
## Format the device and add entry in fstab
mkfs.btrfs "$BTRFS_DEVICE"
UUID="$(blkid -s UUID $BTRFS_DEVICE -o value)"
echo "UUID=$UUID $BTRFS_MOUNT_ROOT btrfs defaults,relatime,compress=lzo,auto 0 0" >> /etc/fstab
## Mount point and mount device
mkdir "$BTRFS_MOUNT_ROOT" -p
mount "$BTRFS_MOUNT_ROOT"
## Build subvolume structure
btrfs subvolume create $BTRFS_MOUNT_ROOT/var
mkdir $BTRFS_MOUNT_ROOT/var/{lib,cache,backups} -p
for d in $BTRFS_MOUNT_ROOT/var/{lib,cache,backups}; do
btrfs subvolume create $d/lxc
done
for d in $BTRFS_MOUNT_ROOT/srv/{,lxc-datastore{,/config,/data}}; do
btrfs subvolume create $d
done
## Add binds to /etc/fstab
cat <<EOF >> /etc/fstab
## binds
/mnt/btrfs-root/var/lib/lxc /var/lib/lxc none bind,defaults,auto 0 0
/mnt/btrfs-root/var/cache/lxc /var/cache/lxc none bind,defaults,auto 0 0
/mnt/btrfs-root/var/backups/lxc /var/backups/lxc none bind,defaults,auto 0 0
/mnt/btrfs-root/srv/lxc-datastore /srv/lxc-datastore none bind,defaults,auto 0 0
EOF
mkdir -p /var/backups/lxc /srv/lxc-datastore
##
## lxc tools
##
apt-get install lxc
mount -a
mkdir -p /opt/apps
##
## ssh config
##
cp src/etc/ssh/lxc_git_access_id_rsa /etc/ssh/lxc_git_access_id_rsa
chmod 0600 /etc/ssh/lxc_git_access_id_rsa
cat <<EOF >> ~/.ssh/config
Host git.0k.io
User lxc-user
IdentityFile /etc/ssh/lxc_git_access_id_rsa
UserKnownHostsFile /dev/null
StrictHostKeyChecking no
Port 10022
EOF
##
## Install 0k-manage
##
(
if ! [ -d "/opt/apps/0k-manage" ]; then
cd /opt/apps &&
git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-manage.git" &&
cd /opt/apps/0k-manage &&
git checkout 0k/prod/master
fi
)
##
## Install 0k-charms
##
(
if ! [ -d "/opt/apps/0k-charms" ]; then
cd /opt/apps &&
git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-charms.git" &&
cd /opt/apps/0k-charms &&
git checkout master
fi
if ! [ -d "/srv/charm-store" ]; then
mkdir -p /srv &&
ln -sf /opt/apps/0k-charms/precise /srv/charm-store
fi
)
##
## Install lxc-scripts
##
(
if ! [ -d "/opt/apps/lxc-scripts" ]; then
cd /opt/apps &&
git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/lxc-scripts.git" &&
cd /opt/apps/0k-manage &&
git checkout master &&
ln -sf /opt/apps/lxc-scripts/bin/lxc-* /usr/local/sbin/ &&
ln -sf /opt/apps/lxc-scripts/usr/lib/lxc/templates/lxc-0k-ubuntu-cloud /usr/lib/lxc/templates/
fi
)
##
## Patch some files
##
stop lxc-net
(
cp src/etc/default/lxc /etc/default/lxc &&
cp src/etc/init/lxc{,-net}.conf /etc/init
)
start lxc-net
##
## Install dns waterfall
##
apt-get install -y bind9 dnsmasq
echo "Change /etc/default/lxc accordingly (use 172.48.#NB) as prefix"
echo "and add HOST_EXTERNAL_DEVICE="
exit 1
# edit /etc/dnsmaq.conf
echo "
server=$(. /etc/default/lxc && echo "$LXC_ADDR")
interface=lo
no-negcache
log-queries
log-facility=/var/log/dnsmasq.log
" >> /etc/dnsmasq.conf
(
cp "src/etc/bind/named.conf.options" "/etc/bind/named.conf.options" &&
sed -ri "s/%%EXTERNAL_IP%%/$(. /etc/default/lxc && ifip "$HOST_EXTERNAL_DEVICE")/g" "/etc/bind/named.conf.options"
)
## XXXvlab: Maybe we could change this in the service start/stop of the named daemon
mkdir /var/log/named -p &&
chown bind:bind /var/log/named
/etc/init.d/bind9 restart
/etc/init.d/dnsmasq restart
##
## Logrotate for dnsmasq and named
##
cat <<EOF > /etc/logrotate.d/dnsmasq
/var/log/dnsmasq.log {
missingok
copytruncate
notifempty
compress
postrotate
kill -s SIGUSR2 "\$(cat /var/run/dnsmasq/dnsmasq.pid)"
endscript
}
EOF
cat <<EOF > /etc/logrotate.d/lxc-dnsmasq
/var/log/lxc-dnsmasq.log {
missingok
copytruncate
notifempty
compress
postrotate
kill -s SIGUSR2 "\$(cat /var/run/lxc/dnsmasq.pid)"
endscript
}
EOF
cat <<EOF > /etc/logrotate.d/named
/var/log/named/*.log {
missingok
copytruncate
notifempty
compress
}
EOF
##
## shorewall
##
apt-get install -y shorewall
cat <<EOF > /etc/shorewall/zones
fw firewall
net ipv4
lan ipv4
EOF
cat <<EOF > /etc/shorewall/interfaces
#ZONE INTERFACE BROADCAST OPTIONS
net eth0
## Uncomment to enable vpn setup
#vpn tun0 detect
lan lxcbr0 - routeback
EOF
cat <<EOF > /etc/shorewall/policy
#SOURCE DEST RULE LOG
fw all ACCEPT
lan all ACCEPT
net all DROP info
all all DROP info
EOF
cat <<EOF > /etc/shorewall/rules
SSH/ACCEPT net fw
Ping/ACCEPT net fw
BEGIN SHELL
host_ip="\$(/sbin/ifconfig eth0 2> /dev/null | sed "s/^.*inet ad\+r://g" | grep ^[0-9] | sed "s/ .*$//g")"
for name in \$(lxc-ls-running); do
ip=\$(dig +short A "\$name")
[ -e "/var/lib/lxc/\$name/shorewall" ] &&
cat /var/lib/lxc/\$name/shorewall | sed -r "s/%%HOST_INTERNET_IP%%/\$host_ip/g" \
| sed -r "s/%%IP%%/\$ip/g"
done
true
END SHELL
EOF
cat <<EOF > /etc/shorewall/masq
eth0 lxcbr0
EOF
##
## Mail facilities
##
(
debconf-set-selections <<< "postfix postfix/mailname string ${MAIL_NAME}.${MAIL_DOMAINNAME}" &&
debconf-set-selections <<< "postfix postfix/main_mailer_type select 'Local only'" &&
apt-get install -y postfix mailutils &&
postconf inet_interfaces=loopback-only &&
[ -z "$MAIL_SATTELITE_RELAYHOST" ] && postconf relayhost="$MAIL_SATTELITE_RELAYHOST"
postfix reload
)
##
## Warnings
##
ln -sf /opt/apps/0k-manage/src/etc/cron.hourly/* /etc/cron.hourly/
ln -sf /opt/apps/lxc-scripts/etc/cron.hourly/* /etc/cron.hourly/
##
## Backup lxc
##
(
if ! [ -d "/opt/apps/0k-manage" ]; then
cd /opt/apps &&
git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-manage.git" &&
cd /opt/apps/0k-manage &&
git checkout 0k/prod/master
fi
## these are required by /etc/cron.hourly/lxc-backup
pip install sact.epoch &&
(cd /usr/local/lib/python2.7/dist-packages/;
mv zope zope-bad) &&
pip install zope.interface --upgrade &&
pip install zope.component --upgrade &&
ln -sf /opt/apps/0k-manage/src/bin/* /usr/local/bin/
)