fork 0k-charms
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

440 lines
8.6 KiB

  1. #!/bin/bash
  2. set -eux # -x for verbose logging to juju debug-log
  3. apt-get update
  4. apt-get -y install bash-completion wget bzip2 git-core less language-pack-en python-software-properties tmux mosh sudo git
  5. ## 0k git remote path
  6. GIT_0K_BASE=${GIT_0K_BASE:-"git.0k.io:/var/git"}
  7. ## 0k git remote options
  8. GIT_0K_CLONE_OPTIONS=${GIT_0K_CLONE_OPTIONS:-""}
  9. #BTRFS_DEVICE=
  10. BTRFS_MOUNT_ROOT=${BTRFS_MOUNT_ROOT:-"/mnt/btrfs-root"}
  11. if [ -z "$BTRFS_DEVICE" ]; then
  12. echo "You must set a BTRFS_DEVICE environement variable prior to executing this hook."
  13. exit 1
  14. fi
  15. MAIL_NAME=${MAIL_NAME:-localhost}
  16. MAIL_DOMAINNAME=${MAIL_DOMAINNAME:-"localdomain"}
  17. MAIL_SATTELITE_RELAYHOST=${MAIL_SATTELITE_RELAYHOST:-}
  18. ##
  19. ## etckeeper
  20. ##
  21. apt-get install etckeeper
  22. sed -i 's/#VCS="git"/VCS="git"/g' /etc/etckeeper/etckeeper.conf
  23. sed -i 's/VCS="bzr"/#VCS="bzr"/g' /etc/etckeeper/etckeeper.conf
  24. etckeeper init
  25. ##
  26. ## Git utilities
  27. ##
  28. echo "[alias]
  29. co = checkout
  30. com = commit
  31. st = status
  32. ci = commit
  33. [color]
  34. branch = auto
  35. diff = auto
  36. interactive = auto
  37. status = auto
  38. " >> /etc/gitconfig
  39. ##
  40. ## kal-scripts
  41. ##
  42. cat <<EOF >> /etc/apt/sources.list
  43. ## vlab's shell libraries
  44. deb http://deb.kalysto.org no-dist kal-alpha kal-beta kal-main
  45. EOF
  46. apt-get update
  47. apt-get install -y --force-yes kal-scripts python-pip &&
  48. pip install shyaml
  49. ##
  50. ## More shell configurations (prompt, functions)
  51. ##
  52. mkdir -p /etc/prompt
  53. cat <<EOF > /etc/prompt/prompt.1.rc
  54. PROMPT_COMMAND=""
  55. parse_git_branch() {
  56. ref=\$(git symbolic-ref HEAD 2> /dev/null) || return
  57. echo -en ' (\033[0;32m'\${ref#refs/heads/}'\033[0m)'
  58. }
  59. export PS1="\[\033[0;37m\][\[\033[1;30m\]\u\[\033[0;37m\]@\[\033[1;30m\]\h\[\033[0;37m\]]-[\[\033[1;34m\]\w\[\033[0;37m\]]\\\$(parse_git_branch)\n\[\033[1;37m\]\\$ \[\033[0;37m\]"
  60. EOF
  61. cat <<EOF >> /root/.bashrc
  62. ## History management
  63. export HISTCONTROL=ignoredups
  64. export HISTSIZE=50000
  65. shopt -s histappend
  66. PROMPT_COMMAND='history -a'
  67. ## Prompt easy management
  68. prompt() {
  69. prompt_name="prompt.\$1.rc"
  70. for i in /etc/prompt ~/.prompt; do
  71. [ -f "\$i/\$prompt_name" ] &&
  72. . "\$i/\$prompt_name"
  73. done
  74. }
  75. ## Git log command
  76. function glog() {
  77. git log --graph --pretty=tformat:%C\(yellow\ normal\)%h%Creset\ %C\(blue\ normal\)%an%Creset\ %s\ %Cgreen%d%Creset -n 20 "\$@"
  78. }
  79. prompt 1
  80. EOF
  81. ##
  82. ## btrfs install
  83. ##
  84. apt-get install -y btrfs-tools
  85. echo "the following is dangerous code. Please execute yourself for now."
  86. exit 1
  87. ## Format the device and add entry in fstab
  88. mkfs.btrfs "$BTRFS_DEVICE"
  89. UUID="$(blkid -s UUID $BTRFS_DEVICE -o value)"
  90. echo "UUID=$UUID $BTRFS_MOUNT_ROOT btrfs defaults,relatime,compress=lzo,auto 0 0" >> /etc/fstab
  91. ## Mount point and mount device
  92. mkdir "$BTRFS_MOUNT_ROOT" -p
  93. mount "$BTRFS_MOUNT_ROOT"
  94. ## Build subvolume structure
  95. btrfs subvolume create $BTRFS_MOUNT_ROOT/var
  96. mkdir $BTRFS_MOUNT_ROOT/var/{lib,cache,backups} -p
  97. for d in $BTRFS_MOUNT_ROOT/var/{lib,cache,backups}; do
  98. btrfs subvolume create $d/lxc
  99. done
  100. for d in $BTRFS_MOUNT_ROOT/srv/{,lxc-datastore{,/config,/data}}; do
  101. btrfs subvolume create $d
  102. done
  103. ## Add binds to /etc/fstab
  104. cat <<EOF >> /etc/fstab
  105. ## binds
  106. /mnt/btrfs-root/var/lib/lxc /var/lib/lxc none bind,defaults,auto 0 0
  107. /mnt/btrfs-root/var/cache/lxc /var/cache/lxc none bind,defaults,auto 0 0
  108. /mnt/btrfs-root/var/backups/lxc /var/backups/lxc none bind,defaults,auto 0 0
  109. /mnt/btrfs-root/srv/lxc-datastore /srv/lxc-datastore none bind,defaults,auto 0 0
  110. EOF
  111. mkdir -p /var/backups/lxc /srv/lxc-datastore
  112. ##
  113. ## lxc tools
  114. ##
  115. apt-get install lxc
  116. mount -a
  117. mkdir -p /opt/apps
  118. ##
  119. ## ssh config
  120. ##
  121. cp src/etc/ssh/lxc_git_access_id_rsa /etc/ssh/lxc_git_access_id_rsa
  122. chmod 0600 /etc/ssh/lxc_git_access_id_rsa
  123. cat <<EOF >> ~/.ssh/config
  124. Host git.0k.io
  125. User lxc-user
  126. IdentityFile /etc/ssh/lxc_git_access_id_rsa
  127. UserKnownHostsFile /dev/null
  128. StrictHostKeyChecking no
  129. Port 10022
  130. EOF
  131. ##
  132. ## Install 0k-manage
  133. ##
  134. (
  135. if ! [ -d "/opt/apps/0k-manage" ]; then
  136. cd /opt/apps &&
  137. git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-manage.git" &&
  138. cd /opt/apps/0k-manage &&
  139. git checkout 0k/prod/master
  140. fi
  141. )
  142. ##
  143. ## Install 0k-charms
  144. ##
  145. (
  146. if ! [ -d "/opt/apps/0k-charms" ]; then
  147. cd /opt/apps &&
  148. git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-charms.git" &&
  149. cd /opt/apps/0k-charms &&
  150. git checkout master
  151. fi
  152. if ! [ -d "/srv/charm-store" ]; then
  153. mkdir -p /srv &&
  154. ln -sf /opt/apps/0k-charms/precise /srv/charm-store
  155. fi
  156. )
  157. ##
  158. ## Install lxc-scripts
  159. ##
  160. (
  161. if ! [ -d "/opt/apps/lxc-scripts" ]; then
  162. cd /opt/apps &&
  163. git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/lxc-scripts.git" &&
  164. cd /opt/apps/0k-manage &&
  165. git checkout master &&
  166. ln -sf /opt/apps/lxc-scripts/bin/lxc-* /usr/local/sbin/ &&
  167. ln -sf /opt/apps/lxc-scripts/usr/lib/lxc/templates/lxc-0k-ubuntu-cloud /usr/lib/lxc/templates/
  168. fi
  169. )
  170. ##
  171. ## Patch some files
  172. ##
  173. stop lxc-net
  174. (
  175. cp src/etc/default/lxc /etc/default/lxc &&
  176. cp src/etc/init/lxc{,-net}.conf /etc/init
  177. )
  178. start lxc-net
  179. ##
  180. ## Install dns waterfall
  181. ##
  182. apt-get install -y bind9 dnsmasq
  183. echo "Change /etc/default/lxc accordingly (use 172.48.#NB) as prefix"
  184. echo "and add HOST_EXTERNAL_DEVICE="
  185. exit 1
  186. # edit /etc/dnsmaq.conf
  187. echo "
  188. server=$(. /etc/default/lxc && echo "$LXC_ADDR")
  189. interface=lo
  190. no-negcache
  191. log-queries
  192. log-facility=/var/log/dnsmasq.log
  193. " >> /etc/dnsmasq.conf
  194. (
  195. cp "src/etc/bind/named.conf.options" "/etc/bind/named.conf.options" &&
  196. sed -ri "s/%%EXTERNAL_IP%%/$(. /etc/default/lxc && ifip "$HOST_EXTERNAL_DEVICE")/g" "/etc/bind/named.conf.options"
  197. )
  198. ## XXXvlab: Maybe we could change this in the service start/stop of the named daemon
  199. mkdir /var/log/named -p &&
  200. chown bind:bind /var/log/named
  201. /etc/init.d/bind9 restart
  202. /etc/init.d/dnsmasq restart
  203. ##
  204. ## Logrotate for dnsmasq and named
  205. ##
  206. cat <<EOF > /etc/logrotate.d/dnsmasq
  207. /var/log/dnsmasq.log {
  208. missingok
  209. copytruncate
  210. notifempty
  211. compress
  212. postrotate
  213. kill -s SIGUSR2 "\$(cat /var/run/dnsmasq/dnsmasq.pid)"
  214. endscript
  215. }
  216. EOF
  217. cat <<EOF > /etc/logrotate.d/lxc-dnsmasq
  218. /var/log/lxc-dnsmasq.log {
  219. missingok
  220. copytruncate
  221. notifempty
  222. compress
  223. postrotate
  224. kill -s SIGUSR2 "\$(cat /var/run/lxc/dnsmasq.pid)"
  225. endscript
  226. }
  227. EOF
  228. cat <<EOF > /etc/logrotate.d/named
  229. /var/log/named/*.log {
  230. missingok
  231. copytruncate
  232. notifempty
  233. compress
  234. }
  235. EOF
  236. ##
  237. ## shorewall
  238. ##
  239. apt-get install -y shorewall
  240. cat <<EOF > /etc/shorewall/zones
  241. fw firewall
  242. net ipv4
  243. lan ipv4
  244. EOF
  245. cat <<EOF > /etc/shorewall/interfaces
  246. #ZONE INTERFACE BROADCAST OPTIONS
  247. net eth0
  248. ## Uncomment to enable vpn setup
  249. #vpn tun0 detect
  250. lan lxcbr0 - routeback
  251. EOF
  252. cat <<EOF > /etc/shorewall/policy
  253. #SOURCE DEST RULE LOG
  254. fw all ACCEPT
  255. lan all ACCEPT
  256. net all DROP info
  257. all all DROP info
  258. EOF
  259. cat <<EOF > /etc/shorewall/rules
  260. SSH/ACCEPT net fw
  261. Ping/ACCEPT net fw
  262. BEGIN SHELL
  263. host_ip="\$(/sbin/ifconfig eth0 2> /dev/null | sed "s/^.*inet ad\+r://g" | grep ^[0-9] | sed "s/ .*$//g")"
  264. for name in \$(lxc-ls-running); do
  265. ip=\$(dig +short A "\$name")
  266. [ -e "/var/lib/lxc/\$name/shorewall" ] &&
  267. cat /var/lib/lxc/\$name/shorewall | sed -r "s/%%HOST_INTERNET_IP%%/\$host_ip/g" \
  268. | sed -r "s/%%IP%%/\$ip/g"
  269. done
  270. true
  271. END SHELL
  272. EOF
  273. cat <<EOF > /etc/shorewall/masq
  274. eth0 lxcbr0
  275. EOF
  276. ##
  277. ## Mail facilities
  278. ##
  279. (
  280. debconf-set-selections <<< "postfix postfix/mailname string ${MAIL_NAME}.${MAIL_DOMAINNAME}" &&
  281. debconf-set-selections <<< "postfix postfix/main_mailer_type select 'Local only'" &&
  282. apt-get install -y postfix mailutils &&
  283. postconf inet_interfaces=loopback-only &&
  284. [ -z "$MAIL_SATTELITE_RELAYHOST" ] && postconf relayhost="$MAIL_SATTELITE_RELAYHOST"
  285. postfix reload
  286. )
  287. ##
  288. ## Warnings
  289. ##
  290. ln -sf /opt/apps/0k-manage/src/etc/cron.hourly/* /etc/cron.hourly/
  291. ln -sf /opt/apps/lxc-scripts/etc/cron.hourly/* /etc/cron.hourly/
  292. ##
  293. ## Backup lxc
  294. ##
  295. (
  296. if ! [ -d "/opt/apps/0k-manage" ]; then
  297. cd /opt/apps &&
  298. git clone $GIT_0K_CLONE_OPTIONS "$GIT_0K_BASE/0k/0k-manage.git" &&
  299. cd /opt/apps/0k-manage &&
  300. git checkout 0k/prod/master
  301. fi
  302. ## these are required by /etc/cron.hourly/lxc-backup
  303. pip install sact.epoch &&
  304. (cd /usr/local/lib/python2.7/dist-packages/;
  305. mv zope zope-bad) &&
  306. pip install zope.interface --upgrade &&
  307. pip install zope.component --upgrade &&
  308. ln -sf /opt/apps/0k-manage/src/bin/* /usr/local/bin/
  309. )