Compare commits
71 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| ff7644a32a | |||
| 5dff08c44d | |||
| 5aff69a05a | |||
| 9dc73bf077 | |||
| cf2b702eb5 | |||
| 23d03f8ba0 | |||
| 5ed8b36c28 | |||
| 3cd5d20de6 | |||
| 2685f7bb11 | |||
| f0270a56ec | |||
| 0f5412ea8b | |||
| 5fb573f447 | |||
| 5b2f572453 | |||
| 958a6225b1 | |||
| 41e7591163 | |||
| 4117afd993 | |||
| c7e438d4ee | |||
| c4065559fc | |||
| e9a2304438 | |||
| e116ba374e | |||
| 76c615ce5e | |||
| dcaa2e3141 | |||
| 006468a46e | |||
| 0f81fba62b | |||
| ca77a73d78 | |||
| e843e6fc74 | |||
| 1dd6092aa8 | |||
| afca48a56d | |||
| 08ff2b0ca8 | |||
| eb809b28b9 | |||
| 982f552f37 | |||
| 16d2a35666 | |||
| 75f173148d | |||
| d13bc4ac37 | |||
| 26081d5d48 | |||
| ea12e28122 | |||
| ef45fe09f4 | |||
| 15af47f8ff | |||
| 1358b062e3 | |||
| b91bff0e43 | |||
| a1c8788e9e | |||
| 2d5ae60d8f | |||
| 9f53cc86f5 | |||
| 9983b9f626 | |||
| cf2508f823 | |||
| 9d686f3e23 | |||
| 330c3f0353 | |||
| 3ead8d14fe | |||
| ce67a4c196 | |||
| 0364cdf7fd | |||
| a2c2105019 | |||
| 20ae031467 | |||
| 797d557afc | |||
| f6d3134004 | |||
| fe8ab22d15 | |||
| bed3b4490e | |||
| 8fa15e33d3 | |||
| 3254d401a9 | |||
| def800e181 | |||
| aa3c77c29a | |||
| 4c1e7bde33 | |||
| 3974c20a84 | |||
| e9ee502ae4 | |||
| 8569a47c03 | |||
| 326f6d7871 | |||
| bdd7f98379 | |||
| ba1737a1fa | |||
| a878cbd4f2 | |||
| 63bb4d160f | |||
| f9b16207d8 | |||
| 75a4b60f57 |
4
.gitignore
vendored
4
.gitignore
vendored
@ -1,10 +1,12 @@
|
||||
.apt-mirror-config
|
||||
.customDocker.sh
|
||||
.customVM.sh
|
||||
.proxy-config
|
||||
.vagrant
|
||||
DEADJOE
|
||||
Vagrantfile
|
||||
/files/log
|
||||
/files/kaz/download
|
||||
/files/kaz/git
|
||||
/files/kaz/log
|
||||
/files/customVM.sh
|
||||
/files/snster-kaz/kaz/prod/customKaz.sh
|
||||
|
||||
45
CACHING.md
Normal file
45
CACHING.md
Normal file
@ -0,0 +1,45 @@
|
||||
# Utilisation d'un cache local
|
||||
|
||||
Il est possible de configurer la VM pour utiliser un proxy et un registre docker du réseau local. L'intérêt est d'avoir un cache persistant lors de la reconstruction de la VM, ou de pouvoir rediriger certaines requêtes (dépôts Debian ou Alpine) vers des miroirs locaux.
|
||||
|
||||
## Configuration de la VM
|
||||
|
||||
Dans le dossier vagrant du host, il faut un fichier `files/customVM.sh`. Un fichier `files/customVM.sh.dist` est fourni en exemple : il suffit de le renommer en `customVM.sh`, puis de modifier les IP du proxy et du registre Docker upstreams dans les premières lignes en remplaçant par son IP privée sur le lan. ```hostname -I``` pour connaître son ip privée.
|
||||
|
||||
Il est évidemment possible de n'activer que l'une des 2 fonctionnalités (soit que le proxy http externe, soit que le docker registry externe) en commentant les lignes associées. D'autres modifications de la VM peuvent aussi être réalisées dans ce fichier...
|
||||
|
||||
## Installation d'un proxy squid sur l'hôte
|
||||
|
||||
Pour installer un squid sur l'hôte :
|
||||
* `apt install squid`
|
||||
* Éditer `/etc/squid/squid.conf` :
|
||||
* Décommenter la ligne `#http_access allow localnet` (ATTENTION ! Il faut bien décommenter cette ligne existante, et non l'ajouter à la fin, sa place dans le fichier de conf est importante). Ne pas confondre `allow localnet` et `allow localhost`.
|
||||
* Ajouter à la fin :
|
||||
```
|
||||
cache_dir aufs /var/spool/squid 5000 14 256
|
||||
maximum_object_size 4000 MB
|
||||
http_port 3142
|
||||
```
|
||||
|
||||
penser à redémarrer le squid: `service squid restart`
|
||||
|
||||
## Installation d'un docker-registry sur l'hôte
|
||||
|
||||
Pour installer un docker-registry sur l'hôte :
|
||||
* `apt install docker-registry`
|
||||
* Éditer `/etc/docker/registry/config.yml` :
|
||||
* Enlever la section `auth`
|
||||
* Ajouter à la fin :
|
||||
```yaml
|
||||
proxy:
|
||||
remoteurl: https://registry-1.docker.io
|
||||
```
|
||||
|
||||
penser à redémarrer: `service docker-registry restart`
|
||||
|
||||
Configurer une IP pérenne
|
||||
-------------------------
|
||||
|
||||
Si vous utilisez un ordinateur portable, votre adresse IP changera sûrement au grè de vos connexions à l'Internet. Dans ce cas il est préférable d'utiliser une adresse stable pour designer votre mandataire.
|
||||
|
||||
Il est par exemple possible d'assigner une seconde adresse à la carte loopback de votre hôte avec `/sbin/ifconfig lo:0 192.168.128.1/24`
|
||||
171
DETAILS.md
171
DETAILS.md
@ -1,171 +0,0 @@
|
||||
# kaz-vagrant
|
||||
|
||||
(ATTENTION, NON À JOUR POUR SNSTER)
|
||||
|
||||
[Kaz](https://kaz.bzh/) est un CHATONS du Morbihan. Nous proposons ici un moyen de le répliquer dans d'autres lieux. Il y a des éléments de configuration à définir avant d'initialiser ce simulateur.
|
||||
|
||||
Le principe est de faire fonctionner un simulateur de notre CHATONS dans une VirtualBox pour mettre au point nos différents services.
|
||||
|
||||
Nous utilisons :
|
||||
* Vagrant pour automatiser la création de la Machine Virtuelle
|
||||
* VirtualBox pour simuler notre serveur
|
||||
* Docker pour chaque service de notre serveur
|
||||
|
||||
## Pré-requis
|
||||
|
||||
Dans la suite, on imagine que vous disposer d'une machine sous Linux (par exemple dernière version de [Debian](https://fr.wikipedia.org/wiki/Debian))
|
||||
|
||||
Vous devez disposer d'un minimum de paquets :
|
||||
|
||||
```bash
|
||||
wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | apt-key add -
|
||||
wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | apt-key add -
|
||||
apt install software-properties-common
|
||||
add-apt-repository "deb [arch=amd64] http://download.virtualbox.org/virtualbox/debian $(lsb_release -cs) contrib"
|
||||
apt update
|
||||
apt install git vagrant virtualbox-6.1 linux-image
|
||||
vagrant plugin install vagrant-disksize
|
||||
```
|
||||
Lancez VirtualBox et vérifiez les mises à jours.
|
||||
|
||||
Par la suite, si vous ne disposez pas d'un bon débit, il est conseiller d'installer `approx` et `squid` pour ne pas recharger systématiquement tous les paquets depuis l'internet.
|
||||
|
||||
pour `approx`, vous pouvez choisir une partition de stockage `/mnt/big/approx`
|
||||
```bash
|
||||
apt-get install approx
|
||||
netstat -ant | grep 9999
|
||||
mkdir /mnt/big/approx
|
||||
chown -R approx : /mnt/big/approx
|
||||
rmdir /var/cache/approx
|
||||
ln -s /mnt/big/approx/ /var/cache/
|
||||
cd /etc/apt/
|
||||
grep -E "^[^#]" sources.list | cut -d " " -f2 | sort -u >> /etc/approx/approx.conf
|
||||
```
|
||||
|
||||
Pour `squid`, vous pouvez choisir une partition de stockage `/mnt/big/squid`
|
||||
|
||||
```bash
|
||||
apt-get install squid
|
||||
emacs /etc/squid/squid.conf
|
||||
|
||||
mkdir /mnt/big/squid
|
||||
chown -R proxy: /mnt/big/squid
|
||||
rmdir /var/spool/squid/
|
||||
ln -s /mnt/big/squid/ /var/spool/squid/
|
||||
|
||||
/etc/init.d/squid restart
|
||||
```
|
||||
|
||||
Si vous utilisez un ordinateur portable, votre adresse IP changera sûrement au grè de vos connexions à l'Internet. Dans ce cas il est préférable d'utiliser une adresse stable pour designer votre mandataire. Après vous êtes connecté, il faudra ajouter une adresse à la carte réseaux qui est active.
|
||||
Dans l'exemple suivant, nous imaginons que la connexion utilise le wifi `wlo1̀ que nous utilisons une classe privée locale `192.168.128.0/25̀ et que notre machine utilisera la première adresse.
|
||||
|
||||
```bash
|
||||
/sbin/ifconfig
|
||||
/sbin/ifconfig wlo1:0 192.168.128.1/25
|
||||
/sbin/ifconfig wlo1:0 up
|
||||
/sbin/ifconfig
|
||||
```
|
||||
|
||||
## Installation
|
||||
|
||||
* Télécharger le dépôt kaz-vagrant ou utilisez la commande :
|
||||
```bash
|
||||
git clone https://git.kaz.bzh/KAZ/kaz-vagrant.git # pour essayer
|
||||
git clone git+ssh://git@git.kaz.bzh:2202/KAZ/kaz-vagrant.git # pour contribuer
|
||||
cd kaz-vagrant/
|
||||
```
|
||||
* Personalisez votre simulateur avec la commande (au besoin ajustez la mémoire et les cpus utilisés dans Vagrantfile) :
|
||||
```bash
|
||||
vagrant plugin install vagrant-disksize
|
||||
init.sh
|
||||
```
|
||||
* Personnalisez le miroir des paquets Debian si vous en avez un (sinon ignorez cette étape).
|
||||
Pour cela créez un fichier qui défini des variables d'environnements qui pointent vers l'hôte et le port (dans l'exemple suivant on prend (machine : **__mirror-host__**, port : **__mirror-port__**) dans un fichier `files/.apt-mirror-config` comme ci-dessous
|
||||
```
|
||||
APT_MIRROR_DEBIAN=mirror-host:mirror-port
|
||||
APT_MIRROR_SECURITY=mirror-host:mirror-port
|
||||
```
|
||||
|
||||
VirtualBox utilise un réseau privé 172.17.X.X
|
||||
|
||||
Pour pouvoir désigner dans conflit votre PC comme mirror, vous pouvez déclarer un autre réseau (par exemple 172.19.X.X)
|
||||
```bash
|
||||
/sbin/ifconfig (eno2) add 172.19.1.1 netmask 255.255.255.0
|
||||
```
|
||||
Dans ce cas, il faut refaire le init.sh pour mettre à jour l'adresse IP du serveur mirroir.
|
||||
|
||||
|
||||
* Pour créer tout l'univers Kaz il faut se placer dans le répertoire et lancer la commande :
|
||||
```bash
|
||||
vagrant up
|
||||
```
|
||||
Il faudra répondre "docker0" à la question "Which interface should the network bridge to?"
|
||||
|
||||
|
||||
Il est possible d'interrompre la création à la coquille vide (sans les services) pour des question de mise au point avec la commande :
|
||||
```bash
|
||||
NOKAZ="true" vagrant up
|
||||
```
|
||||
Il se peut que le répertoire `/vagrant` ne soit pas monté. Dans ce cas. Quittez la VM et relancez `vagrant up`.
|
||||
|
||||
Il est possible de choisir de tester une autres branche de développement du dépôt de Kaz.
|
||||
```bash
|
||||
KAZBRANCH="develop" vagrant up
|
||||
```
|
||||
|
||||
* Une fois la commande de création de l'univers, il faut patienter...
|
||||
|
||||
* Après il faut patienter encore un peu si on a pas la fibre ...
|
||||
|
||||
La fenêtre de virtualbox va se lancer et l'installation va se poursuivre
|
||||
|
||||
La progression est visible dans la fenêtre où la commande vagrant est lancée.
|
||||
|
||||
## Utilisation
|
||||
|
||||
Les utilisateurs créés sont
|
||||
* debian/debian
|
||||
* root/root.
|
||||
|
||||
Si vous avec laissé la création des dockers, il faut bien attendre la fermeture automatique de la fenêtre et l'apparition de l'écran de connexion (on vous a dit que c'était long).
|
||||
|
||||
|
||||
Vous pouvez alors démarrer le client de messagerie clawsmail dans lequel 4 comptes ont été paramétrés (contact1@kaz.local, contact2@kaz.local, contact3@kaz.local, contact4@kaz.local)
|
||||
|
||||
Il y a un aperçu de l'état des services avec l'url https://kaz.local/status/allServices.html
|
||||
|
||||
|
||||
|
||||
Les erreurs 502 correspondent à des fonctions en cours de développement. Les message "Can't open this page" correspond au fait que le services refuse pour des raison de sécurité de de fonctionner embarqué dans une page.
|
||||
|
||||
|
||||
Vous pouvez également démarrer firefox avec les URL suivantes:
|
||||
* https://www.kaz.local
|
||||
* https://tableur.kaz.local
|
||||
* https://pad.kaz.local
|
||||
|
||||
* https://depot.kaz.local
|
||||
* https://agora.kaz.local/login (compte contact1@kaz.local créé, mot de passe toto)
|
||||
* https://cloud.kaz.local/login (compte contact1@kaz.local créé, mot de passe totototototototo1234 )
|
||||
* https://sondage.kaz.local
|
||||
|
||||
Il vous faudra accepter les alertes de sécurité pour certificat absent (web et messagerie)
|
||||
|
||||
## Echanges avec la machine virtuelle
|
||||
|
||||
En cas de nouvelle re-création, la clef privée sera mise à jour. Il faudra effacer l'ancienne pour ne pas avoir le message :
|
||||
```
|
||||
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
||||
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
|
||||
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
|
||||
```
|
||||
|
||||
Pour cela il faut supprimer l'entrée des hôtes connus :
|
||||
```bash
|
||||
ssh-keygen -f ~/.ssh/known_hosts -R "[127.0.0.1]:2222"
|
||||
```
|
||||
|
||||
Pour copier des fichiers vers la machine virtuelle :
|
||||
```bash
|
||||
rsync -rlptDEHAX --no-o -e "ssh -p 2222 -i ~/git/kaz-vagrant/.vagrant/machines/default/virtualbox/private_key" src vagrant@127.0.0.1:/dst
|
||||
```
|
||||
79
README.md
79
README.md
@ -1,7 +1,6 @@
|
||||
# kaz-vagrant
|
||||
|
||||
[Kaz](https://kaz.bzh/) est un CHATONS du Morbihan. Nous proposons ici un moyen de le répliquer dans une VM. Il y a des éléments de configuration à définir avant d'initialiser ce simulateur.
|
||||
|
||||
Le principe est de faire fonctionner un simulateur de notre CHATONS dans une VirtualBox pour mettre au point nos différents services.
|
||||
|
||||
Nous utilisons :
|
||||
@ -11,7 +10,7 @@ Nous utilisons :
|
||||
* LXC pour faire tourner ces services dans des conteneurs distincts (ie, kaz-prod est un conteneur LXC)
|
||||
* Docker pour chaque service de notre serveur
|
||||
|
||||
À la fin, nous obtenons une maquette d'un petit internet simulé, avec du DNS, des mails tiers, et notre serveur kaz-prod dans un coin.
|
||||
À la fin, nous obtenons une maquette d'un petit internet simulé, avec du DNS, des mails tiers, et nos serveurs hoster-a-kaz1 et hoster-b-kaz2 dans un coin.
|
||||
|
||||
|
||||
|
||||
@ -20,51 +19,25 @@ Nous utilisons :
|
||||
|
||||
Vous avez besoin de [vagrant](https://www.vagrantup.com/), [VirtualBox](https://www.virtualbox.org/) et éventuellement git.
|
||||
|
||||
UDP/53 ne doit pas être filtré depuis votre poste (par un firewall d'entreprise par exemple). Pour tester:
|
||||
```bash
|
||||
# dig @80.67.169.12 www.kaz.bzh
|
||||
```
|
||||
|
||||
## Installation
|
||||
|
||||
* Télécharger le dépôt kaz-vagrant, branche develop-snster, ou utilisez la commande git :
|
||||
* Télécharger le dépôt kaz-vagrant ou utilisez la commande git :
|
||||
```bash
|
||||
git clone https://git.kaz.bzh/KAZ/kaz-vagrant.git # pour essayer
|
||||
git clone git+ssh://git@git.kaz.bzh:2202/KAZ/kaz-vagrant.git # pour contribuer
|
||||
cd kaz-vagrant/
|
||||
git switch develop-snster # dans les 2 cas
|
||||
```
|
||||
* Personalisez votre simulateur avec la commande (au besoin ajustez la mémoire et les cpus utilisés dans Vagrantfile) :
|
||||
```bash
|
||||
vagrant plugin install vagrant-disksize
|
||||
vagrant plugin install vagrant-vbguest
|
||||
./init.sh # vous pouvez laisser les choix par défaut
|
||||
```
|
||||
* (Optionnel) Ajustez éventuellement la mémoire et les cpus utilisés dans Vagrantfile (par défaut 4GB et 2 vCPUs)
|
||||
|
||||
* Pour créer tout l'univers Kaz il faut se placer dans le répertoire et lancer la commande :
|
||||
```bash
|
||||
vagrant up
|
||||
```
|
||||
|
||||
Cette étape peut-être (très) longue. Notamment, la construction de kaz-prod se fait dans un conteneur LXC, dans lequel les overlays docker passent par un filesystem FUSE beaucoup plus lent qu'en natif...
|
||||
Cette étape peut-être (très) longue, notamment la construction des machines Kaz... Comptez entre 40 minutes et quelques heures, selon la connexion réseau et les performances de la machine.
|
||||
|
||||
|
||||
## Mise au point
|
||||
|
||||
Il est possible d'interrompre la création à la coquille vide (juste la VM sans les services KAZ) pour des question de mise au point avec la commande :
|
||||
```bash
|
||||
NOKAZ="true" vagrant up
|
||||
```
|
||||
|
||||
Dans ce cas, il faudra ensuite lancer dans la VM :
|
||||
```bash
|
||||
KAZGUARD="true" /root/vm-install-kaz.sh
|
||||
```
|
||||
|
||||
Pour détruire la VM et recommencer :
|
||||
```bash
|
||||
vagrant destroy
|
||||
```
|
||||
|
||||
|
||||
## Utilisation
|
||||
|
||||
@ -72,17 +45,18 @@ Les utilisateurs créés sont
|
||||
* debian/debian
|
||||
* root/root.
|
||||
|
||||
Si vous avec laissé la création de Kaz, il faut bien attendre la fermeture automatique de la fenêtre et l'apparition de l'écran de connexion (on vous a dit que c'était long).
|
||||
Se connecter en root/root
|
||||
|
||||
Lors du démarrage de la VM, il faut lancer SNSTER et éventuellement les conteneurs :
|
||||
Lors du démarrage de la VM, il faut lancer SNSTER :
|
||||
```bash
|
||||
cd /root/snster-kaz
|
||||
snster start
|
||||
```
|
||||
|
||||
Normalement, kaz-prod lance automatiquement les dockers (dans son rc.local), mais si ça ne marche pas bien il peut falloir les relancer (que se passe-t-il si on relance container.sh pendant que container.sh n'est pas encore fini ? faut-il l'enlever du rc.local ? Le lancement initial peut rater, probablement si le DNS n'est pas encore fonctionnel lors du lancement, à mettre au point et peut-être enlever du rc.local ?)
|
||||
Normalement, hoster-a-kaz1 et hoster-b-kaz2 lancent automatiquement les dockers (dans rc.local), mais si ça ne marche pas bien il peut falloir les relancer (que se passe-t-il si on relance container.sh pendant que container.sh n'est pas encore fini ? faut-il l'enlever du rc.local ? Le lancement initial peut rater, probablement si le DNS n'est pas encore fonctionnel lors du lancement, à mettre au point et peut-être enlever du rc.local ?)
|
||||
```bash
|
||||
snster attach kaz-prod -x /kaz/bin/container.sh start
|
||||
snster attach hoster-a-kaz1 -x /kaz/bin/container.sh start
|
||||
snster attach hoster-b-kaz2 -x /kaz/bin/container.sh start
|
||||
```
|
||||
|
||||
Vous pouvez alors (toutes les commandes snster doivent être exécutées dans `/root/snster-kaz`) :
|
||||
@ -90,17 +64,20 @@ Vous pouvez alors (toutes les commandes snster doivent être exécutées dans `/
|
||||
* Ouvrir Firefox et naviguer vers :
|
||||
* `https://www.kaz.sns`, le Kaz interne à la VM
|
||||
* `https://listes.kaz.sns`, le sympa interne à la VM
|
||||
* `https://pad2.kaz.sns`, le pad sur kaz2
|
||||
* `https://www.kaz.bzh`, le vrai Kaz
|
||||
* Ouvrir claws-mail et retrouver les comptes mails configurés :
|
||||
* `contact1@kaz.sns` à `contact4@kaz.sns`, hébergés sur le kaz-prod de la VM
|
||||
* `email@isp-a.sns`, hébergé dans le conteneur LXC isp-a-infra
|
||||
* Travailler sur kaz-prod : `snster attach kaz-prod`
|
||||
* Travailler sur hoster-a-kaz1 : `snster attach hoster-a-kaz1`
|
||||
* Afficher un plan de réseau : `snster print`
|
||||
* Le système de fichiers de kaz-prod est accessible directement dans la VM:
|
||||
* `/kaz-prod/` [VM] correspond à `/` [kaz-prod]
|
||||
* `/kaz` [VM] correspond à `/kaz` [kaz-prod]
|
||||
* Le système de fichiers de hoster-a-kaz1 est accessible directement dans la VM:
|
||||
* `/kaz1-prod/` [VM] correspond à `/` [hoster-a-kaz1]
|
||||
* `/kaz` [VM] correspond à `/kaz` [hoster-a-kaz1]
|
||||
* Il est probablement pratique d'installer son environnement de développement sur la VM, avec ses clés SSH et son éditeur favori.
|
||||
|
||||
Dans Vagrantfile, existent des répertoires partagés entre le host et le VM mais pour qu'ils soient visibles depuis la VM, il faut démarrer la VM non pas avec VirtualBox mais avec Vagrant up.
|
||||
|
||||
Il y a un aperçu de l'état des services avec l'url https://kaz.sns/status/allServices.html
|
||||
|
||||
|
||||
@ -117,8 +94,24 @@ Vous pouvez également démarrer firefox avec les URL suivantes:
|
||||
* https://cloud.kaz.sns/login (compte contact1@kaz.local créé, mot de passe totototototototo1234 )
|
||||
* https://sondage.kaz.sns
|
||||
|
||||
Il vous faudra accepter les alertes de sécurité pour certificat absent (web et messagerie)
|
||||
Il vous faudra accepter les éventuelles alertes de sécurité pour certificat absent (web et messagerie)
|
||||
|
||||
## Installation avancée
|
||||
## Mise au point
|
||||
|
||||
L'installation avancée, notamment pour utiliser d'autres miroirs ou des caches APT, est décrite dans le fichier [DETAILS.md](DETAILS.md).
|
||||
Pour réinstaller Kaz sur kaz1 (avec suppression de /kaz, des volumes dockers et réinstallation complète; idem kaz2), depuis la VM :
|
||||
```bash
|
||||
snster attach hoster-a-kaz1 -x "/root/kaz.sh"
|
||||
```
|
||||
|
||||
Pour détruire la VM et recommencer, depuis l'hôte :
|
||||
```bash
|
||||
vagrant destroy
|
||||
vagrant up
|
||||
```
|
||||
|
||||
Accélération de la construction avec un proxy cache local
|
||||
---------------------------------------------------------
|
||||
|
||||
Au tout début de la construction de la VM, un proxy Squid et un proxy Dockerhub (docker-registry) sont installés au niveau de la VM. Ils font du cache et sont ensuite utilisé lors des apt-get du provisionning de la VM puis lors des constructions des conteneurs LXC et des dockers. Quelques téléchargements ne sont pas encore mis en cache (soit parce que certains téléchargements se font hors de ce proxy, soit par l'utilisation du HTTPS qui n'est pas (encore) intercepté pour faire ce cache), mais cela diminue déjà beaucoup le trafic réseau lors de la construction et lors des reconstructions partielles ensuite.
|
||||
|
||||
Il est possible de configurer ce proxy pour utiliser un proxy du réseau local à son tour. L'intérêt est d'avoir un cache persistant lors de la reconstruction de la VM, ou de pouvoir rediriger certaines requêtes (dépôts Debian ou Alpine) vers des miroirs locaux. L'installation et la configuration sont décrites dans le fichier [CACHING.md](CACHING.md)
|
||||
|
||||
32
Vagrantfile
vendored
Normal file
32
Vagrantfile
vendored
Normal file
@ -0,0 +1,32 @@
|
||||
# coding: utf-8
|
||||
# -*- mode: ruby -*-
|
||||
# vi: set ft=ruby :
|
||||
|
||||
# All Vagrant configuration is done below. The "2" in Vagrant.configure
|
||||
# configures the configuration version (we support older styles for
|
||||
# backwards compatibility). Please don't change it unless you know what
|
||||
# you're doing.
|
||||
Vagrant.configure("2") do |config|
|
||||
|
||||
config.vm.box = "debian/bookworm64"
|
||||
config.vm.hostname = 'kaz-vm'
|
||||
|
||||
config.vm.provider "virtualbox" do |vb|
|
||||
vb.memory = "4096"
|
||||
vb.cpus = "2"
|
||||
vb.name = "kaz-vm"
|
||||
vb.customize ["modifyvm", :id, "--vram", "64", "--clipboard-mode", "bidirectional", '--graphicscontroller', 'vmsvga', '--natnet1', '192.168.64.0/24']
|
||||
vb.gui = true
|
||||
end
|
||||
|
||||
|
||||
|
||||
#permet d'avoir un répertoire partagé entre la VM et le host
|
||||
config.vm.synced_folder "/tmp/", "/tmp_host"
|
||||
config.vm.synced_folder "files/", "/root/kaz-vagrant"
|
||||
|
||||
config.vm.provision "shell" do |s|
|
||||
s.inline = "/vagrant/files/vm-provision.sh"
|
||||
s.env = {"KAZGUARD" => "true", "HOSTLANG" => ENV['LANG'], "NOKAZ" => ENV['NOKAZ'], "KAZBRANCH" => ENV['KAZBRANCH']}
|
||||
end
|
||||
end
|
||||
@ -1,95 +0,0 @@
|
||||
# coding: utf-8
|
||||
# -*- mode: ruby -*-
|
||||
# vi: set ft=ruby :
|
||||
|
||||
unless Vagrant.has_plugin?("vagrant-disksize")
|
||||
raise Vagrant::Errors::VagrantError.new, "vagrant-disksize plugin is missing. Please install it using 'vagrant plugin install vagrant-disksize' and rerun 'vagrant up'"
|
||||
end
|
||||
|
||||
# All Vagrant configuration is done below. The "2" in Vagrant.configure
|
||||
# configures the configuration version (we support older styles for
|
||||
# backwards compatibility). Please don't change it unless you know what
|
||||
# you're doing.
|
||||
Vagrant.configure("2") do |config|
|
||||
|
||||
required_plugins = %w( vagrant-vbguest vagrant-disksize )
|
||||
_retry = false
|
||||
required_plugins.each do |plugin|
|
||||
unless Vagrant.has_plugin? plugin
|
||||
system "vagrant plugin install #{plugin}"
|
||||
_retry=true
|
||||
end
|
||||
end
|
||||
|
||||
if (_retry)
|
||||
exec "vagrant " + ARGV.join(' ')
|
||||
end
|
||||
|
||||
config.vm.box = "debian/bullseye64"
|
||||
config.vm.hostname = 'kaz-vm'
|
||||
config.disksize.size = '32GB'
|
||||
|
||||
# Disable automatic box update checking. If you disable this, then
|
||||
# boxes will only be checked for updates when the user runs
|
||||
# `vagrant box outdated`. This is not recommended.
|
||||
# config.vm.box_check_update = false
|
||||
|
||||
# Create a forwarded port mapping which allows access to a specific port
|
||||
# within the machine from a port on the host machine. In the example below,
|
||||
# accessing "localhost:8080" will access port 80 on the guest machine.
|
||||
# config.vm.network "forwarded_port", guest: 80, host: 8080
|
||||
|
||||
# Create a private network, which allows host-only access to the machine
|
||||
# using a specific IP.
|
||||
# config.vm.network "private_network", ip: "192.168.33.10"
|
||||
|
||||
# Create a public network, which generally matched to bridged network.
|
||||
# Bridged networks make the machine appear as another physical device on
|
||||
# your network.
|
||||
# config.vm.network "public_network"
|
||||
|
||||
# Share an additional folder to the guest VM. The first argument is
|
||||
# the path on the host to the actual folder. The second argument is
|
||||
# the path on the guest to mount the folder. And the optional third
|
||||
# argument is a set of non-required options.
|
||||
# config.vm.synced_folder "data", "/vagrant_data"
|
||||
# config.vm.synced_folder "..", "/root/mi-lxc", create:true, type:"rsync",
|
||||
# rsync__exclude: [".git/", "zzlocal/", "vagrant/"]
|
||||
|
||||
# Provider-specific configuration so you can fine-tune various
|
||||
# backing providers for Vagrant. These expose provider-specific options.
|
||||
# Example for VirtualBox:
|
||||
#
|
||||
config.vm.provider "virtualbox" do |vb|
|
||||
# # Display the VirtualBox GUI when booting the machine
|
||||
# vb.gui = true
|
||||
#
|
||||
# # Customize the amount of memory on the VM:
|
||||
vb.memory = "4096"
|
||||
vb.cpus="2"
|
||||
vb.name = "kaz-vm"
|
||||
vb.customize ["modifyvm", :id, "--vram", "64", "--clipboard-mode", "bidirectional", '--graphicscontroller', 'vmsvga', '--natnet1', '192.168.64.0/24']
|
||||
vb.gui = true
|
||||
|
||||
end
|
||||
|
||||
# Define a Vagrant Push strategy for pushing to Atlas. Other push strategies
|
||||
# such as FTP and Heroku are also available. See the documentation at
|
||||
# https://docs.vagrantup.com/v2/push/atlas.html for more information.
|
||||
# config.push.define "atlas" do |push|
|
||||
# push.app = "YOUR_ATLAS_USERNAME/YOUR_APPLICATION_NAME"
|
||||
# end
|
||||
|
||||
# Enable provisioning with a shell script. Additional provisioners such as
|
||||
# Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
|
||||
# documentation for more information about their specific syntax and use.
|
||||
|
||||
#permet d'avoir un répertoire partagé entre la VM et le host
|
||||
config.vm.synced_folder "/tmp/", "/tmp_host"
|
||||
config.vm.synced_folder "files/", "/root/kaz-vagrant"
|
||||
|
||||
config.vm.provision "shell" do |s|
|
||||
s.inline = "/vagrant/files/vm-provision.sh"
|
||||
s.env = {"KAZGUARD" => "true", "HOSTLANG" => ENV['LANG'], "NOKAZ" => ENV['NOKAZ'], "KAZBRANCH" => ENV['KAZBRANCH']}
|
||||
end
|
||||
end
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 156 KiB After Width: | Height: | Size: 103 KiB |
42
files/customVM.sh.dist
Normal file
42
files/customVM.sh.dist
Normal file
@ -0,0 +1,42 @@
|
||||
#!/bin/bash
|
||||
|
||||
PROXY="192.168.0.121:3128"
|
||||
REGISTRY="192.168.0.121:5000"
|
||||
|
||||
# Pour le proxy http/https (https sans cache) avec iptables
|
||||
cat >> /etc/rc.local <<EOF
|
||||
#!/bin/sh
|
||||
PROXY=${PROXY}
|
||||
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 3142 -j DNAT --to \${PROXY}
|
||||
iptables -t nat -A OUTPUT -p tcp -m tcp --dport 3142 -j DNAT --to \${PROXY}
|
||||
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
EOF
|
||||
chmod +x /etc/rc.local
|
||||
echo "net.ipv4.conf.eth0.route_localnet=1" >> /etc/sysctl.conf
|
||||
sysctl -p
|
||||
# fin proxy
|
||||
|
||||
# Pour le cache docker
|
||||
cat >> /etc/rc.local <<EOF
|
||||
REGISTRY=${REGISTRY}
|
||||
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 5000 -j DNAT --to \${REGISTRY}
|
||||
EOF
|
||||
# fin cache docker
|
||||
|
||||
|
||||
bash /etc/rc.local
|
||||
|
||||
# Un peu de customisation
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y vim rsync
|
||||
rsync -a /vagrant/files/.emacs* /root/
|
||||
|
||||
|
||||
###
|
||||
# Une autre façon de router vers un autre proxy http/https upstream, si on veut que la VM fasse le cache
|
||||
###
|
||||
# Pour le proxy http/https (https sans cache) avec squid config
|
||||
#echo "cache_peer $(cut -d':' -f1 <<< $PROXY) parent $(cut -d':' -f2 <<< $PROXY) 0 no-query default
|
||||
#acl all src 0.0.0.0/0.0.0.0
|
||||
#http_access allow all
|
||||
#never_direct allow all" >> /etc/squid/squid.conf
|
||||
#service squid restart
|
||||
@ -1,8 +1,8 @@
|
||||
version: 1
|
||||
|
||||
header:
|
||||
name: Target AS
|
||||
comment: AS of the Target organization
|
||||
name: Hoster-A AS
|
||||
comment: AS of the first hoster of Kaz CHATONS
|
||||
|
||||
hosts:
|
||||
router:
|
||||
@ -14,10 +14,10 @@ hosts:
|
||||
ipv4: 100.64.0.10/24
|
||||
ipv6: 2001:db8:b000::10/48
|
||||
eth1:
|
||||
bridge: kaz-lan1
|
||||
bridge: ha-lan1
|
||||
ipv4: 100.80.0.1/24
|
||||
eth2:
|
||||
bridge: kaz-lan2
|
||||
bridge: ha-lan2
|
||||
ipv4: 100.80.1.1/24
|
||||
templates:
|
||||
- bgprouter:
|
||||
@ -29,14 +29,14 @@ hosts:
|
||||
ns: 100.100.100.100
|
||||
domain: kaz.sns
|
||||
|
||||
prod:
|
||||
kaz1:
|
||||
network:
|
||||
interfaces:
|
||||
eth0:
|
||||
bridge: kaz-lan1
|
||||
bridge: ha-lan1
|
||||
ipv4: 100.80.0.2/24
|
||||
eth1:
|
||||
bridge: kaz-lan2
|
||||
bridge: ha-lan2
|
||||
ipv4: 100.80.1.2/24
|
||||
gatewayv4: 100.80.0.1
|
||||
templates:
|
||||
25
files/snster-kaz/hoster-a/kaz1/createUser.txt
Normal file
25
files/snster-kaz/hoster-a/kaz1/createUser.txt
Normal file
@ -0,0 +1,25 @@
|
||||
# -- fichier de création des comptes KAZ
|
||||
# --
|
||||
# -- 1 ligne par compte
|
||||
# -- champs séparés par ;. les espaces en début et en fin sont enlevés
|
||||
# -- laisser vide si pas de donnée
|
||||
# -- pas d'espace dans les variables
|
||||
# --
|
||||
# -- ORGA: nom de l'organisation (max 15 car), vide sinon
|
||||
# -- ADMIN_ORGA: O/N indique si le user est admin de l'orga (va le créer comme admin du NC de l'orga et admin de l'équipe agora)
|
||||
# -- NC_ORGA: O/N indique si l'orga a demandé un NC
|
||||
# -- GARRADIN_ORGA: O/N indique si l'orga a demandé un garradin
|
||||
# -- WP_ORGA: O/N indique si l'orga a demandé un wp
|
||||
# -- AGORA_ORGA: O/N indique si l'orga a demandé un mattermost
|
||||
# -- WIKI_ORGA: O/N indique si l'orga a demandé un wiki
|
||||
# -- NC_BASE: O/N indique si le user doit être inscrit dans le NC de base
|
||||
# -- GROUPE_NC_BASE: soit null soit le groupe dans le NC de base
|
||||
# -- EQUIPE_AGORA: soit null soit equipe agora (max 15 car)
|
||||
# -- QUOTA=(1/10/20/...) en GB
|
||||
# --
|
||||
# NOM ; PRENOM ; EMAIL_SOUHAITE ; EMAIL_SECOURS ; ORGA ; ADMIN_ORGA ; NC_ORGA ; GARRADIN_ORGA ; WP_ORGA ; AGORA_ORGA ; WIKI_ORGA ; NC_BASE ; GROUPE_NC_BASE ; EQUIPE_AGORA ; QUOTA
|
||||
|
||||
Hello1;Contact1;contact1@kaz.sns;contact2@kaz.sns; ;N;N;N;N;N;N;N; ; ;1;tototototo
|
||||
Hello2;Contact2;contact2@kaz.sns;contact2@kaz.sns; ;N;N;N;N;N;N;N; ; ;1;tototototo
|
||||
Hello3;Contact3;contact3@kaz.sns;contact2@kaz.sns; ;N;N;N;N;N;N;N; ; ;10;tototototo
|
||||
Hello4;Contact4;contact4@kaz.sns;contact2@kaz.sns; ;N;N;N;N;N;N;N; ; ;10;tototototo
|
||||
@ -1,3 +1,4 @@
|
||||
# e-mail server composer
|
||||
ldap
|
||||
postfix
|
||||
sympa
|
||||
@ -0,0 +1,2 @@
|
||||
#proxy
|
||||
traefik
|
||||
@ -4,6 +4,9 @@ dokuwiki
|
||||
garradin
|
||||
gitea
|
||||
jirafeau
|
||||
#mattermost
|
||||
mattermost
|
||||
roundcube
|
||||
#keycloak
|
||||
mobilizon
|
||||
vaultwarden
|
||||
ldap
|
||||
@ -3,8 +3,7 @@ jirafeau
|
||||
ethercalc
|
||||
collabora
|
||||
ethercalc
|
||||
#etherpad
|
||||
ldap
|
||||
etherpad
|
||||
quotas
|
||||
web
|
||||
#vigilo
|
||||
@ -19,7 +19,8 @@ domain_sympa=listes.kaz.sns
|
||||
########################################
|
||||
# choix d'un serveur partiel
|
||||
# site=site-2
|
||||
site=
|
||||
site=kaz1
|
||||
acme_server="https://ca.mica.sns/acme/acme/directory"
|
||||
|
||||
########################################
|
||||
# Pour garradin qui met en "dure" dans
|
||||
@ -59,6 +60,15 @@ sympaHost=listes
|
||||
vigiloHost=vigilo
|
||||
webmailHost=webmail
|
||||
wordpressHost=wp
|
||||
ldapUIHost=mdp
|
||||
mobilizonHost=mobilizon
|
||||
vaultwardenHost=koffre
|
||||
traefikHost=dashboard
|
||||
|
||||
########################################
|
||||
# ports internes
|
||||
|
||||
matterPort=8000
|
||||
|
||||
########################################
|
||||
# noms des containers
|
||||
@ -77,6 +87,7 @@ mattermostServName=mattermostServ
|
||||
nextcloudServName=nextcloudServ
|
||||
officeServName=officeServ
|
||||
proxyServName=proxyServ
|
||||
traefikServName=traefikServ
|
||||
quotasServName=quotasServ
|
||||
roundcubeServName=roundcubeServ
|
||||
smtpServName=mailServ
|
||||
@ -84,6 +95,8 @@ sympaServName=sympaServ
|
||||
vigiloServName=vigiloServ
|
||||
webServName=webServ
|
||||
wordpressServName=wpServ
|
||||
mobilizonServName=mobilizonServ
|
||||
vaultwardenServName=vaultwardenServ
|
||||
|
||||
cachetDBName=cachetDB
|
||||
ethercalcDBName=ethercalcDB
|
||||
@ -97,6 +110,8 @@ roundcubeDBName=roundcubeDB
|
||||
sympaDBName=sympaDB
|
||||
vigiloDBName=vigiloDB
|
||||
wordpressDBName=wpDB
|
||||
mobilizonDBName=mobilizonDB
|
||||
vaultwardenDBName=vaultwardenDB
|
||||
|
||||
ldapUIName=ldapUI
|
||||
|
||||
52
files/snster-kaz/hoster-a/kaz1/kaz.sh
Executable file
52
files/snster-kaz/hoster-a/kaz1/kaz.sh
Executable file
@ -0,0 +1,52 @@
|
||||
#!/bin/bash
|
||||
if [ -z "${SNSTERGUARD}" ] ; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DIR=$(cd "$(dirname $0)"; pwd)
|
||||
cd "${DIR}"
|
||||
set -e
|
||||
export OUTPUT_DIR="/root/install"
|
||||
|
||||
|
||||
mkdir -p "${OUTPUT_DIR}/log/"
|
||||
export DebugLog="${OUTPUT_DIR}/log/log-kaz-$(date +%y-%m-%d-%T)-"
|
||||
(
|
||||
echo "########## ********** Start kaz.sh $(date +%D-%T)"
|
||||
|
||||
docker-clean -a
|
||||
rm -rf /kaz
|
||||
|
||||
if [ -z "${KAZBRANCH}" ] ; then
|
||||
KAZBRANCH="master"
|
||||
fi
|
||||
echo -e "\n #### git checkout ${KAZBRANCH}\n"
|
||||
|
||||
# copie des sources
|
||||
cd /
|
||||
git clone https://git.kaz.bzh/KAZ/KazV2.git kaz
|
||||
(cd /kaz ; git checkout "${KAZBRANCH}" )
|
||||
|
||||
cp "${DIR}/kaz-config/dockers.env" /kaz/config/dockers.env
|
||||
for type in mail orga proxy withMail withoutMail ; do
|
||||
[ -f "${DIR}/kaz-config/container-${type}.list" ] &&
|
||||
cp "${DIR}/kaz-config/container-${type}.list" /kaz/config/
|
||||
done
|
||||
|
||||
echo -e "\n #### secretGen\n"
|
||||
/kaz/bin/secretGen.sh
|
||||
|
||||
echo -e "\n #### install\n"
|
||||
/kaz/bin/install.sh
|
||||
|
||||
# On crée quelques comptes
|
||||
mkdir -p /kaz/tmp
|
||||
cp /root/createUser.txt /kaz/tmp/
|
||||
/kaz/bin/createUser.sh -e || true
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
|
||||
echo "########## ********** End kaz.sh $(date +%D-%T)"
|
||||
) > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
|
||||
43
files/snster-kaz/hoster-a/kaz1/kaz.sns.zone
Normal file
43
files/snster-kaz/hoster-a/kaz1/kaz.sns.zone
Normal file
@ -0,0 +1,43 @@
|
||||
$TTL 86400
|
||||
$ORIGIN kaz.sns.
|
||||
@ 1D IN SOA ns.kaz.sns. hostmaster.kaz.sns. (
|
||||
2002022401 ; serial
|
||||
3H ; refresh
|
||||
15 ; retry
|
||||
1w ; expire
|
||||
3h ; nxdomain ttl
|
||||
)
|
||||
IN NS ns.kaz.sns.
|
||||
IN MX 10 smtp.kaz.sns.
|
||||
IN A 100.80.0.2
|
||||
ns IN A 100.80.0.2
|
||||
kaz1 IN A 100.80.0.2
|
||||
kaz2 IN A 100.81.0.2
|
||||
smtp IN CNAME kaz1
|
||||
imap IN CNAME kaz1
|
||||
www IN CNAME kaz1
|
||||
mail IN CNAME kaz1
|
||||
cloud IN CNAME kaz1
|
||||
tableur IN CNAME kaz1
|
||||
dashboard IN CNAME kaz1
|
||||
dashboard2 IN CNAME kaz2
|
||||
sondage IN CNAME kaz1
|
||||
webmail IN CNAME kaz1
|
||||
garradin IN CNAME kaz1
|
||||
wiki IN CNAME kaz1
|
||||
git IN CNAME kaz1
|
||||
office IN CNAME kaz1
|
||||
depot IN CNAME kaz1
|
||||
ldap IN CNAME kaz1
|
||||
mobilizon IN CNAME kaz1
|
||||
mdp IN CNAME kaz1
|
||||
koffre IN CNAME kaz1
|
||||
pad IN CNAME kaz1
|
||||
agora IN CNAME kaz1
|
||||
listes IN MX 10 listes
|
||||
pad2 IN CNAME kaz2
|
||||
listes IN A 100.80.1.2
|
||||
firewall IN A 100.80.0.1
|
||||
firewall IN AAAA 2001:db8:80::0:1
|
||||
router IN A 100.80.0.1
|
||||
router IN AAAA 2001:db8:80::0:1
|
||||
138
files/snster-kaz/hoster-a/kaz1/provision.sh
Normal file
138
files/snster-kaz/hoster-a/kaz1/provision.sh
Normal file
@ -0,0 +1,138 @@
|
||||
#!/bin/bash
|
||||
# Target DMZ
|
||||
set -e
|
||||
if [ -z $SNSTERGUARD ] ; then exit 1; fi
|
||||
DIR=`dirname $0`
|
||||
cd `dirname $0`
|
||||
|
||||
DEB_VERSION=`cat /etc/debian_version | cut -d'.' -f1`
|
||||
if [ $DEB_VERSION -eq "11" ] # DEB 11 aka Bullseye
|
||||
then
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
fi
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get remove -y apache2
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
|
||||
|
||||
# Go KAZ !
|
||||
# KAZ specific things
|
||||
#installation de docker, docker-compose et on y fourre le user debian dans le groupe idoine
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y dos2unix jq ldapvi argon2 docker.io docker-clean git apg curl sudo unzip rsync btrfs-progs ldap-utils unaccent # fuse-overlayfs
|
||||
usermod -G docker debian
|
||||
|
||||
# docker-compose
|
||||
curl -SL https://github.com/docker/compose/releases/download/v2.17.3/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
|
||||
sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
|
||||
chmod +x /usr/bin/docker-compose
|
||||
|
||||
# activation dans alias dans /root/.bashrc
|
||||
sed -i \
|
||||
-e 's/^\# alias/alias/g' \
|
||||
-e 's/^\# export/export/g' \
|
||||
-e 's/^\# eval/eval/g' \
|
||||
/root/.bashrc
|
||||
|
||||
if ! grep -q "for file in /dockers" /root/.bashrc 2>/dev/null; then
|
||||
cat >> /root/.bashrc <<EOF
|
||||
# enable bash completion in interactive shells
|
||||
if ! shopt -oq posix; then
|
||||
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
||||
. /usr/share/bash-completion/bash_completion
|
||||
elif [ -f /etc/bash_completion ]; then
|
||||
. /etc/bash_completion
|
||||
fi
|
||||
fi
|
||||
for file in /kaz/bin/.*-completion.bash ; do
|
||||
source "\${file}"
|
||||
done
|
||||
EOF
|
||||
fi
|
||||
|
||||
|
||||
# On met le GUARD pour la mise au point
|
||||
echo "export SNSTERGUARD='true'" >> /root/.bashrc
|
||||
|
||||
|
||||
# On place les certifs
|
||||
cp -ar tls/root_ca.crt /usr/local/share/ca-certificates/
|
||||
/usr/sbin/update-ca-certificates --fresh
|
||||
|
||||
mkdir -p /etc/letsencrypt/live/kaz.sns
|
||||
cp tls/wildcard.crt /etc/letsencrypt/live/kaz.sns/fullchain.pem
|
||||
cp tls/wildcard.key /etc/letsencrypt/live/kaz.sns/privkey.pem
|
||||
|
||||
# On sauve le proxy APT
|
||||
proxy=$(/sbin/ip route | awk '/default/ { print $3 }' | head -1)
|
||||
sed -i -e "s/^proxy.*$/proxy=$proxy/" /usr/local/sbin/detect_proxy.sh
|
||||
#echo "export http_proxy=\"http://$proxy:3142\"" > /etc/profile.d/proxy.sh
|
||||
#echo "export https_proxy=\"http://$proxy:3142\"" >> /etc/profile.d/proxy.sh
|
||||
|
||||
# Proxy pour les environnements durant les dockerbuilds
|
||||
mkdir /root/.docker
|
||||
echo "{
|
||||
\"proxies\":
|
||||
{
|
||||
\"default\":
|
||||
{
|
||||
\"httpProxy\": \"http://$proxy:3142\",
|
||||
\"httpsProxy\": \"http://$proxy:3142\",
|
||||
\"noProxy\": \"*.sns,127.0.0.1,localhost,127.0.0.0/8,100.64.0.0/10,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,agora\"
|
||||
}
|
||||
}
|
||||
}" > /root/.docker/config.json
|
||||
|
||||
# Proxy pour les docker pull -> commenté car pas de cache avec dockerhub
|
||||
# echo "http_proxy=\"http://$proxy:3142\"
|
||||
# https_proxy=\"http://$proxy:3142\"
|
||||
# no_proxy=\"*.sns,127.0.0.0/8,100.64.0.0/10,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\"
|
||||
# " >> /etc/default/docker
|
||||
|
||||
# On active btrfs+registry miroir pour docker
|
||||
cat >> /etc/docker/daemon.json <<EOF
|
||||
{ "storage-driver": "btrfs",
|
||||
"registry-mirrors": ["http://$proxy:5000"] }
|
||||
EOF
|
||||
service docker restart
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
|
||||
# On installe Kaz
|
||||
ifconfig lo:0 100.80.0.2
|
||||
ifconfig lo:1 100.80.1.2
|
||||
echo "100.80.0.2 smtp imap www mail cloud cloud.kaz.sns tableur tableur.kaz.sns webmail webmail.kaz.sns garradin garradin.kaz.sns wiki wiki.kaz.sns git git.kaz.sns office office.kaz.sns depot depot.kaz.sns ldap ldap.kaz.sns mdp mdp.kaz.sns koffre koffre.kaz.sns pad pad.kaz.sns agora agora.kaz.sns dashboard dashboard.kaz.sns" >> /etc/hosts
|
||||
echo "100.80.1.2 listes listes.kaz.sns" >> /etc/hosts
|
||||
cp "${DIR}/kaz.sh" /root/kaz.sh
|
||||
cp "${DIR}/createUser.txt" /root/
|
||||
cp -ar "${DIR}/kaz-config" /root/
|
||||
chmod +x /root/kaz.sh
|
||||
bash "/root/kaz.sh"
|
||||
sed -i -e "s/100.80.0.2.*//g" /etc/hosts
|
||||
sed -i -e "s/100.80.1.2.*//g" /etc/hosts
|
||||
|
||||
|
||||
# On démarre au boot
|
||||
echo -e '#!/bin/sh\n/kaz/bin/container.sh start' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
|
||||
|
||||
# notes fuse-overlayfs :
|
||||
#mknod -m 666 /dev/fuse c 10 229
|
||||
#echo -e '#!/bin/sh\nmknod -m 666 /dev/fuse c 10 229' >> /etc/rc.local
|
||||
#chmod +x /etc/rc.local
|
||||
|
||||
# lxc.cgroup2.devices.allow = b 7:* rwm
|
||||
# lxc.cgroup2.devices.allow = c 10:237 rwm
|
||||
#
|
||||
# mknod -m 666 /dev/loop0 b 7 0
|
||||
# mknod -m 666 /dev/loop-control c 10 237
|
||||
# truncate -s 30G /root/varlibdocker.img
|
||||
# mkfs.btrfs /root/varlibdocker.img
|
||||
# losetup -f /root/varlibdocker.img
|
||||
# mount /dev/loop0 /var/lib/docker
|
||||
40
files/snster-kaz/hoster-b/group.yml
Normal file
40
files/snster-kaz/hoster-b/group.yml
Normal file
@ -0,0 +1,40 @@
|
||||
version: 1
|
||||
|
||||
header:
|
||||
name: Hoster-B AS
|
||||
comment: AS of the second hoster of Kaz CHATONS
|
||||
|
||||
hosts:
|
||||
router:
|
||||
master: alpine
|
||||
network:
|
||||
interfaces:
|
||||
eth0:
|
||||
bridge: transit-a
|
||||
ipv4: 100.64.0.11/24
|
||||
ipv6: 2001:db8:b000::11/48
|
||||
eth1:
|
||||
bridge: hb-lan1
|
||||
ipv4: 100.81.0.1/24
|
||||
templates:
|
||||
- bgprouter:
|
||||
asn: 11
|
||||
asdev: eth1
|
||||
neighbors4: 100.64.0.1 as 30
|
||||
neighbors6: 2001:db8:b000::1 as 30
|
||||
- resolv:
|
||||
ns: 100.100.100.100
|
||||
domain: kaz.sns
|
||||
|
||||
kaz2:
|
||||
network:
|
||||
interfaces:
|
||||
eth0:
|
||||
bridge: hb-lan1
|
||||
ipv4: 100.81.0.2/24
|
||||
gatewayv4: 100.81.0.1
|
||||
templates:
|
||||
- updatecaroots:
|
||||
- resolv:
|
||||
domain: kaz.sns
|
||||
ns: 100.100.100.100
|
||||
@ -0,0 +1,4 @@
|
||||
# e-mail server composer
|
||||
#ldap
|
||||
#postfix
|
||||
#sympa
|
||||
@ -0,0 +1 @@
|
||||
# orga composer
|
||||
@ -0,0 +1,2 @@
|
||||
#proxy
|
||||
traefik
|
||||
@ -0,0 +1,12 @@
|
||||
#cloud
|
||||
#dokuwiki
|
||||
#framadate
|
||||
#garradin
|
||||
#gitea
|
||||
#jirafeau
|
||||
#mattermost
|
||||
#roundcube
|
||||
#keycloak
|
||||
#mobilizon
|
||||
#vaultwarden
|
||||
#ldap
|
||||
@ -0,0 +1,8 @@
|
||||
#cachet
|
||||
#jirafeau
|
||||
#ethercalc
|
||||
#collabora
|
||||
etherpad
|
||||
#quotas
|
||||
#web
|
||||
#vigilo
|
||||
135
files/snster-kaz/hoster-b/kaz2/kaz-config/dockers.env
Normal file
135
files/snster-kaz/hoster-b/kaz2/kaz-config/dockers.env
Normal file
@ -0,0 +1,135 @@
|
||||
# Les variables d'environnements utilisées
|
||||
# par les dockers via le lien :
|
||||
# .env -> ../../config/dockers.env
|
||||
|
||||
#######################################
|
||||
# prod / dev / local
|
||||
mode=local
|
||||
|
||||
########################################
|
||||
# choix du domaine
|
||||
# prod=kaz.bzh / dev=dev.kaz.bzh / local=kaz.local
|
||||
domain=kaz.sns
|
||||
|
||||
########################################
|
||||
# choix du domaine des mails sympa
|
||||
# prod=kaz.bzh / dev=kaz2.ovh / local=kaz.local
|
||||
domain_sympa=listes.kaz.sns
|
||||
|
||||
########################################
|
||||
# choix d'un serveur partiel
|
||||
# site=site-2
|
||||
site=kaz2
|
||||
acme_server="https://ca.mica.sns/acme/acme/directory"
|
||||
|
||||
########################################
|
||||
# Pour garradin qui met en "dure" dans
|
||||
# sa config l'URL pour l'atteindre
|
||||
|
||||
# prod=https (gandi) / dev=https (letsencrypt) / local=http
|
||||
httpProto=https
|
||||
|
||||
# prod=89.234.186.111 / dev=192.168.57.1 / local=127.0.0.1
|
||||
MAIN_IP=100.81.0.2
|
||||
|
||||
# prod=89.234.186.151 / dev=192.168.57.2 / local=127.0.0.2
|
||||
SYMPA_IP=100.81.1.2
|
||||
|
||||
########################################
|
||||
# noms des services
|
||||
|
||||
# ou www (mais bof)
|
||||
webHost=
|
||||
|
||||
cachetHost=cachet
|
||||
calcHost=tableur
|
||||
cloudHost=cloud
|
||||
dateHost=sondage
|
||||
dokuwikiHost=wiki
|
||||
fileHost=depot
|
||||
garHost=garradin
|
||||
gitHost=git
|
||||
gravHost=grav
|
||||
ldapHost=ldap
|
||||
matterHost=agora
|
||||
officeHost=office
|
||||
padHost=pad2
|
||||
quotasHost=quotas
|
||||
smtpHost=smtp
|
||||
sympaHost=listes
|
||||
vigiloHost=vigilo
|
||||
webmailHost=webmail
|
||||
wordpressHost=wp
|
||||
ldapUIHost=mdp
|
||||
mobilizonHost=mobilizon
|
||||
vaultwardenHost=koffre
|
||||
traefikHost=dashboard2
|
||||
|
||||
########################################
|
||||
# ports internes
|
||||
|
||||
matterPort=8000
|
||||
|
||||
########################################
|
||||
# noms des containers
|
||||
|
||||
cachetServName=cachetServ
|
||||
dokuwikiServName=dokuwikiServ
|
||||
ethercalcServName=ethercalcServ
|
||||
etherpadServName=etherpadServ
|
||||
framadateServName=framadateServ
|
||||
garradinServName=garradinServ
|
||||
gitServName=gitServ
|
||||
gravServName=gravServ
|
||||
jirafeauServName=jirafeauServ
|
||||
ldapServName=ldapServ
|
||||
mattermostServName=mattermostServ
|
||||
nextcloudServName=nextcloudServ
|
||||
officeServName=officeServ
|
||||
proxyServName=proxyServ
|
||||
traefikServName=traefikServ
|
||||
quotasServName=quotasServ
|
||||
roundcubeServName=roundcubeServ
|
||||
smtpServName=mailServ
|
||||
sympaServName=sympaServ
|
||||
vigiloServName=vigiloServ
|
||||
webServName=webServ
|
||||
wordpressServName=wpServ
|
||||
mobilizonServName=mobilizonServ
|
||||
vaultwardenServName=vaultwardenServ
|
||||
|
||||
cachetDBName=cachetDB
|
||||
ethercalcDBName=ethercalcDB
|
||||
etherpadDBName=etherpadDB
|
||||
framadateDBName=framadateDB
|
||||
gitDBName=gitDB
|
||||
mattermostDBName=mattermostDB
|
||||
nextcloudDBName=nextcloudDB
|
||||
quotasDBName=quotasDB
|
||||
roundcubeDBName=roundcubeDB
|
||||
sympaDBName=sympaDB
|
||||
vigiloDBName=vigiloDB
|
||||
wordpressDBName=wpDB
|
||||
mobilizonDBName=mobilizonDB
|
||||
vaultwardenDBName=vaultwardenDB
|
||||
|
||||
ldapUIName=ldapUI
|
||||
|
||||
########################################
|
||||
# politique de redémarrage
|
||||
# prod=always / test=unless-stopped / local=no
|
||||
restartPolicy=no
|
||||
|
||||
########################################
|
||||
# devrait être dans env-jirafeauServ
|
||||
# mais seuls les variables de ".env" sont
|
||||
# utilisables pour le montage des volumes
|
||||
|
||||
jirafeauDir=/var/jirafeauData/lkuDM16R5Sp4QHr/
|
||||
|
||||
ldap_root=dc=kaz,dc=sns
|
||||
|
||||
########################################
|
||||
# services activés par container.sh
|
||||
# variables d'environneements utilisées
|
||||
# pour le tmpl du mandataire (proxy)
|
||||
50
files/snster-kaz/hoster-b/kaz2/kaz.sh
Normal file
50
files/snster-kaz/hoster-b/kaz2/kaz.sh
Normal file
@ -0,0 +1,50 @@
|
||||
#!/bin/bash
|
||||
if [ -z "${SNSTERGUARD}" ] ; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DIR=$(cd "$(dirname $0)"; pwd)
|
||||
cd "${DIR}"
|
||||
set -e
|
||||
export OUTPUT_DIR="/root/install"
|
||||
|
||||
|
||||
mkdir -p "${OUTPUT_DIR}/log/"
|
||||
export DebugLog="${OUTPUT_DIR}/log/log-kaz-$(date +%y-%m-%d-%T)-"
|
||||
(
|
||||
echo "########## ********** Start kaz.sh $(date +%D-%T)"
|
||||
|
||||
docker-clean -a
|
||||
rm -rf /kaz
|
||||
|
||||
if [ -z "${KAZBRANCH}" ] ; then
|
||||
KAZBRANCH="master"
|
||||
fi
|
||||
echo -e "\n #### git checkout ${KAZBRANCH}\n"
|
||||
|
||||
# copie des sources
|
||||
cd /
|
||||
git clone https://git.kaz.bzh/KAZ/KazV2.git kaz
|
||||
(cd /kaz ; git checkout "${KAZBRANCH}" )
|
||||
|
||||
cp "${DIR}/kaz-config/dockers.env" /kaz/config/dockers.env
|
||||
for type in mail orga proxy withMail withoutMail ; do
|
||||
[ -f "${DIR}/kaz-config/container-${type}.list" ] &&
|
||||
cp "${DIR}/kaz-config/container-${type}.list" /kaz/config/
|
||||
done
|
||||
|
||||
# copie certif de la CA locale pour traefik (nécessaire pour ACME/Smallstep)
|
||||
cp /usr/local/share/ca-certificates/root_ca.crt /kaz/dockers/traefik/conf/
|
||||
|
||||
echo -e "\n #### secretGen\n"
|
||||
/kaz/bin/secretGen.sh
|
||||
|
||||
echo -e "\n #### install\n"
|
||||
/kaz/bin/install.sh
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
|
||||
echo "########## ********** End kaz.sh $(date +%D-%T)"
|
||||
) > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
|
||||
135
files/snster-kaz/hoster-b/kaz2/provision.sh
Normal file
135
files/snster-kaz/hoster-b/kaz2/provision.sh
Normal file
@ -0,0 +1,135 @@
|
||||
#!/bin/bash
|
||||
# Target DMZ
|
||||
set -e
|
||||
if [ -z $SNSTERGUARD ] ; then exit 1; fi
|
||||
DIR=`dirname $0`
|
||||
cd `dirname $0`
|
||||
|
||||
DEB_VERSION=`cat /etc/debian_version | cut -d'.' -f1`
|
||||
if [ $DEB_VERSION -eq "11" ] # DEB 11 aka Bullseye
|
||||
then
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
fi
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get remove -y apache2
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
|
||||
|
||||
# Go KAZ !
|
||||
# KAZ specific things
|
||||
#installation de docker, docker-compose et on y fourre le user debian dans le groupe idoine
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y dos2unix jq ldapvi argon2 docker.io docker-clean git apg curl sudo unzip rsync btrfs-progs ldap-utils unaccent # fuse-overlayfs
|
||||
usermod -G docker debian
|
||||
|
||||
# docker-compose
|
||||
curl -SL https://github.com/docker/compose/releases/download/v2.17.3/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
|
||||
sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
|
||||
chmod +x /usr/bin/docker-compose
|
||||
|
||||
# activation dans alias dans /root/.bashrc
|
||||
sed -i \
|
||||
-e 's/^\# alias/alias/g' \
|
||||
-e 's/^\# export/export/g' \
|
||||
-e 's/^\# eval/eval/g' \
|
||||
/root/.bashrc
|
||||
|
||||
if ! grep -q "for file in /dockers" /root/.bashrc 2>/dev/null; then
|
||||
cat >> /root/.bashrc <<EOF
|
||||
# enable bash completion in interactive shells
|
||||
if ! shopt -oq posix; then
|
||||
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
||||
. /usr/share/bash-completion/bash_completion
|
||||
elif [ -f /etc/bash_completion ]; then
|
||||
. /etc/bash_completion
|
||||
fi
|
||||
fi
|
||||
for file in /kaz/bin/.*-completion.bash ; do
|
||||
source "\${file}"
|
||||
done
|
||||
EOF
|
||||
fi
|
||||
|
||||
|
||||
# On met le GUARD pour la mise au point
|
||||
echo "export SNSTERGUARD='true'" >> /root/.bashrc
|
||||
|
||||
|
||||
# On place les certifs
|
||||
cp -ar tls/root_ca.crt /usr/local/share/ca-certificates/
|
||||
/usr/sbin/update-ca-certificates --fresh
|
||||
|
||||
mkdir -p /etc/letsencrypt/live/kaz.sns
|
||||
cp tls/wildcard.crt /etc/letsencrypt/live/kaz.sns/fullchain.pem
|
||||
cp tls/wildcard.key /etc/letsencrypt/live/kaz.sns/privkey.pem
|
||||
|
||||
# On sauve le proxy APT
|
||||
proxy=$(/sbin/ip route | awk '/default/ { print $3 }' | head -1)
|
||||
sed -i -e "s/^proxy.*$/proxy=$proxy/" /usr/local/sbin/detect_proxy.sh
|
||||
#echo "export http_proxy=\"http://$proxy:3142\"" > /etc/profile.d/proxy.sh
|
||||
#echo "export https_proxy=\"http://$proxy:3142\"" >> /etc/profile.d/proxy.sh
|
||||
|
||||
# Proxy pour les environnements durant les dockerbuilds
|
||||
mkdir /root/.docker
|
||||
echo "{
|
||||
\"proxies\":
|
||||
{
|
||||
\"default\":
|
||||
{
|
||||
\"httpProxy\": \"http://$proxy:3142\",
|
||||
\"httpsProxy\": \"http://$proxy:3142\",
|
||||
\"noProxy\": \"*.sns,127.0.0.1,localhost,127.0.0.0/8,100.64.0.0/10,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,agora\"
|
||||
}
|
||||
}
|
||||
}" > /root/.docker/config.json
|
||||
|
||||
# Proxy pour les docker pull -> commenté car pas de cache avec dockerhub
|
||||
# echo "http_proxy=\"http://$proxy:3142\"
|
||||
# https_proxy=\"http://$proxy:3142\"
|
||||
# no_proxy=\"*.sns,127.0.0.0/8,100.64.0.0/10,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\"
|
||||
# " >> /etc/default/docker
|
||||
|
||||
# On active btrfs+registry miroir pour docker
|
||||
cat >> /etc/docker/daemon.json <<EOF
|
||||
{ "storage-driver": "btrfs",
|
||||
"registry-mirrors": ["http://$proxy:5000"] }
|
||||
EOF
|
||||
service docker restart
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
|
||||
# On installe Kaz
|
||||
docker network create postfixNet # temp fix
|
||||
ifconfig lo:0 100.81.0.2
|
||||
echo "100.81.0.2 smtp imap www mail cloud cloud.kaz.sns tableur tableur.kaz.sns webmail webmail.kaz.sns garradin garradin.kaz.sns wiki wiki.kaz.sns git git.kaz.sns office office.kaz.sns depot depot.kaz.sns ldap ldap.kaz.sns mdp mdp.kaz.sns koffre koffre.kaz.sns pad pad.kaz.sns agora agora.kaz.sns dashboard dashboard.kaz.sns" >> /etc/hosts
|
||||
cp "${DIR}/kaz.sh" /root/kaz.sh
|
||||
cp -ar "${DIR}/kaz-config" /root/
|
||||
chmod +x /root/kaz.sh
|
||||
bash "/root/kaz.sh"
|
||||
sed -i -e "s/100.81.0.2.*//g" /etc/hosts
|
||||
|
||||
|
||||
# On démarre au boot
|
||||
echo -e '#!/bin/sh\n/kaz/bin/container.sh start' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
|
||||
|
||||
# notes fuse-overlayfs :
|
||||
#mknod -m 666 /dev/fuse c 10 229
|
||||
#echo -e '#!/bin/sh\nmknod -m 666 /dev/fuse c 10 229' >> /etc/rc.local
|
||||
#chmod +x /etc/rc.local
|
||||
|
||||
# lxc.cgroup2.devices.allow = b 7:* rwm
|
||||
# lxc.cgroup2.devices.allow = c 10:237 rwm
|
||||
#
|
||||
# mknod -m 666 /dev/loop0 b 7 0
|
||||
# mknod -m 666 /dev/loop-control c 10 237
|
||||
# truncate -s 30G /root/varlibdocker.img
|
||||
# mkfs.btrfs /root/varlibdocker.img
|
||||
# losetup -f /root/varlibdocker.img
|
||||
# mount /dev/loop0 /var/lib/docker
|
||||
@ -15,17 +15,16 @@ DEBIAN_FRONTEND=noninteractive apt-get install -y claws-mail
|
||||
|
||||
# On configure les comptes mail
|
||||
if [ -f /clawsmail/addclawsuser.sh ]; then
|
||||
su debian /clawsmail/addclawsuser.sh contact1 kaz.sns contact1@kaz.sns toto 1
|
||||
su debian /clawsmail/addclawsuser.sh contact2 kaz.sns contact2@kaz.sns toto 2
|
||||
su debian /clawsmail/addclawsuser.sh contact3 kaz.sns contact3@kaz.sns toto 3
|
||||
su debian /clawsmail/addclawsuser.sh contact4 kaz.sns contact4@kaz.sns toto 4
|
||||
su debian /clawsmail/addclawsuser.sh contact1 kaz.sns contact1@kaz.sns tototototo 1
|
||||
su debian /clawsmail/addclawsuser.sh contact2 kaz.sns contact2@kaz.sns tototototo 2
|
||||
su debian /clawsmail/addclawsuser.sh contact3 kaz.sns contact3@kaz.sns tototototo 3
|
||||
su debian /clawsmail/addclawsuser.sh contact4 kaz.sns contact4@kaz.sns tototototo 4
|
||||
su debian /clawsmail/addclawsuser.sh email isp-a.sns email email 5
|
||||
fi
|
||||
|
||||
# On place les certifs
|
||||
if [ -d letsencrypt ]; then
|
||||
cp -ar letsencrypt /etc/
|
||||
cp /etc/letsencrypt/local/rootCA.pem /usr/local/share/ca-certificates/root.crt
|
||||
if [ -f tls/root_ca.crt ]; then
|
||||
cp -ar tls/root_ca.crt /usr/local/share/ca-certificates/root.crt
|
||||
/usr/sbin/update-ca-certificates --fresh
|
||||
fi
|
||||
|
||||
|
||||
@ -7,13 +7,17 @@ cd `dirname $0`
|
||||
|
||||
# Email's mail account email@isp-a.sns
|
||||
useradd -m -s "/bin/bash" -p `mkpasswd --method=sha-512 email` email || true
|
||||
addgroup email mail
|
||||
adduser email mail
|
||||
#mkdir /home/hacker/mail
|
||||
#touch /home/hacker/mail/Drafts /home/hacker/mail/Queue /home/hacker/mail/Sent /home/hacker/mail/Trash
|
||||
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
DEB_VERSION=`cat /etc/debian_version | cut -d'.' -f1`
|
||||
if [ $DEB_VERSION -eq "11" ] # DEB 11 aka Bullseye
|
||||
then
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
fi
|
||||
|
||||
# manage isp-a.sns zone
|
||||
apt-get update
|
||||
|
||||
@ -1,71 +0,0 @@
|
||||
#!/bin/bash
|
||||
if [ -z "${SNSTERGUARD}" ] ; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DIR=$(cd "$(dirname $0)"; pwd)
|
||||
cd "${DIR}"
|
||||
set -e
|
||||
export OUTPUT_DIR="/root/install"
|
||||
|
||||
|
||||
mkdir -p "${OUTPUT_DIR}/log/"
|
||||
export DebugLog="${OUTPUT_DIR}/log/log-kaz-$(date +%y-%m-%d-%T)-"
|
||||
(
|
||||
echo "########## ********** Start kaz.sh $(date +%D-%T)"
|
||||
|
||||
docker-clean -a
|
||||
rm -rf /kaz
|
||||
|
||||
if [ -z "${KAZBRANCH}" ] ; then
|
||||
KAZBRANCH="master"
|
||||
fi
|
||||
echo -e "\n #### git checkout ${KAZBRANCH}\n"
|
||||
|
||||
|
||||
# copie des sources
|
||||
cd /
|
||||
[ -f kaz ] || git clone https://git.kaz.bzh/KAZ/kaz.git
|
||||
(cd /kaz ; git checkout "${KAZBRANCH}" )
|
||||
find /kaz -name \*.sh -exec chmod a+x {} \;
|
||||
|
||||
# pour ceux qui disposent d'un cache apt local et pas la fibre
|
||||
if [ -f "${DIR}/.apt-mirror-config" ]; then
|
||||
rsync -a "${DIR}/.apt-mirror-config" /kaz/
|
||||
fi
|
||||
if [ -f "${DIR}/.proxy-config" ]; then
|
||||
rsync -a "${DIR}/.proxy-config" /etc/profile.d/proxy.sh
|
||||
rsync -a "${DIR}/.proxy-config" /kaz/
|
||||
fi
|
||||
if [ -f "${DIR}/.docker-config.json" ]; then
|
||||
mkdir -p /root/.docker
|
||||
rsync -a "${DIR}/.docker-config.json" /root/.docker/config.json
|
||||
fi
|
||||
|
||||
|
||||
|
||||
echo -e "\n #### rsync download\n"
|
||||
[ -d "${DIR}/kaz/download" ] &&
|
||||
rsync -a "${DIR}/kaz/download/" /kaz/download/
|
||||
[ -d "${DIR}/kaz/git" ] &&
|
||||
rsync -a "${DIR}/kaz/git/" /kaz/git/
|
||||
[ -f "${DIR}/kaz/config/dockers.env" ] &&
|
||||
[ ! -f "/kaz/config/dockers.env" ] &&
|
||||
rsync -a "${DIR}/kaz/config/dockers.env" /kaz/config/dockers.env
|
||||
for type in mail orga proxy withMail withoutMail ; do
|
||||
[ -f "${DIR}/kaz/config/container-${type}.list" ] &&
|
||||
[ ! -f "/kaz/config/config/container-${type}.list" ] &&
|
||||
rsync -a "${DIR}/kaz/config/container-${type}.list" /kaz/config/
|
||||
done
|
||||
|
||||
echo -e "\n #### secretGen\n"
|
||||
/kaz/bin/secretGen.sh
|
||||
|
||||
/kaz/bin/install.sh
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
|
||||
echo "########## ********** End kaz.sh $(date +%D-%T)"
|
||||
) > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
|
||||
@ -1,33 +0,0 @@
|
||||
$TTL 86400
|
||||
$ORIGIN kaz.sns.
|
||||
@ 1D IN SOA ns.kaz.sns. hostmaster.kaz.sns. (
|
||||
2002022401 ; serial
|
||||
3H ; refresh
|
||||
15 ; retry
|
||||
1w ; expire
|
||||
3h ; nxdomain ttl
|
||||
)
|
||||
IN NS ns.kaz.sns.
|
||||
IN MX 10 smtp.kaz.sns.
|
||||
IN A 100.80.0.2
|
||||
ns IN A 100.80.0.2
|
||||
dmz IN A 100.80.0.2
|
||||
smtp IN CNAME dmz
|
||||
imap IN CNAME dmz
|
||||
www IN CNAME dmz
|
||||
mail IN CNAME dmz
|
||||
cloud IN CNAME dmz
|
||||
tableur IN CNAME dmz
|
||||
webmail IN CNAME dmz
|
||||
garradin IN CNAME dmz
|
||||
wiki IN CNAME dmz
|
||||
git IN CNAME dmz
|
||||
office IN CNAME dmz
|
||||
depot IN CNAME dmz
|
||||
ldap IN CNAME dmz
|
||||
listes IN MX 10 listes
|
||||
listes IN A 100.80.1.2
|
||||
firewall IN A 100.80.0.1
|
||||
firewall IN AAAA 2001:db8:80::0:1
|
||||
router IN A 100.80.0.1
|
||||
router IN AAAA 2001:db8:80::0:1
|
||||
@ -1 +0,0 @@
|
||||
proxy
|
||||
@ -1,85 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Target DMZ
|
||||
set -e
|
||||
if [ -z $SNSTERGUARD ] ; then exit 1; fi
|
||||
DIR=`dirname $0`
|
||||
cd `dirname $0`
|
||||
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get remove -y apache2
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
|
||||
|
||||
# Go KAZ !
|
||||
# KAZ specific things
|
||||
#installation de docker, docker-compose et on y fourre le user debian dans le groupe idoine
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y docker.io docker-compose docker-clean git apg curl sudo unzip rsync btrfs-progs ldap-utils # fuse-overlayfs
|
||||
usermod -G docker debian
|
||||
# activation dans alias dans /root/.bashrc
|
||||
sed -i \
|
||||
-e 's/^\# alias/alias/g' \
|
||||
-e 's/^\# export/export/g' \
|
||||
-e 's/^\# eval/eval/g' \
|
||||
/root/.bashrc
|
||||
|
||||
if ! grep -q "for file in /dockers" /root/.bashrc 2>/dev/null; then
|
||||
cat >> /root/.bashrc <<EOF
|
||||
# enable bash completion in interactive shells
|
||||
if ! shopt -oq posix; then
|
||||
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
||||
. /usr/share/bash-completion/bash_completion
|
||||
elif [ -f /etc/bash_completion ]; then
|
||||
. /etc/bash_completion
|
||||
fi
|
||||
fi
|
||||
for file in /kaz/bin/.*-completion.bash ; do
|
||||
source "\${file}"
|
||||
done
|
||||
EOF
|
||||
fi
|
||||
|
||||
|
||||
# On met le GUARD pour la mise au point
|
||||
echo "export SNSTERGUARD='true'" >> /root/.bashrc
|
||||
|
||||
# On active fuse-overlayfs pour docker
|
||||
cat >> /etc/docker/daemon.json <<EOF
|
||||
{ "storage-driver": "btrfs" }
|
||||
EOF
|
||||
service docker restart
|
||||
|
||||
#mknod -m 666 /dev/fuse c 10 229
|
||||
#echo -e '#!/bin/sh\nmknod -m 666 /dev/fuse c 10 229' >> /etc/rc.local
|
||||
#chmod +x /etc/rc.local
|
||||
|
||||
# lxc.cgroup2.devices.allow = b 7:* rwm
|
||||
# lxc.cgroup2.devices.allow = c 10:237 rwm
|
||||
#
|
||||
# mknod -m 666 /dev/loop0 b 7 0
|
||||
# mknod -m 666 /dev/loop-control c 10 237
|
||||
# truncate -s 30G /root/varlibdocker.img
|
||||
# mkfs.btrfs /root/varlibdocker.img
|
||||
# losetup -f /root/varlibdocker.img
|
||||
# mount /dev/loop0 /var/lib/docker
|
||||
|
||||
# On place les certifs
|
||||
if [ -d letsencrypt ]; then
|
||||
cp -ar letsencrypt /etc/
|
||||
cp /etc/letsencrypt/local/rootCA.pem /usr/local/share/ca-certificates/rootCA.crt
|
||||
/usr/sbin/update-ca-certificates --fresh
|
||||
fi
|
||||
|
||||
# ./kaz.sh
|
||||
|
||||
# On démarre au boot
|
||||
echo -e '#!/bin/sh\n/kaz/bin/container.sh start' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get clean
|
||||
@ -7,14 +7,14 @@ header:
|
||||
config:
|
||||
prefix: kaz
|
||||
nat-bridge: lxcbr0
|
||||
default-master: bullseye
|
||||
default-master: bookworm
|
||||
|
||||
masters:
|
||||
bullseye:
|
||||
bookworm:
|
||||
backend: lxc
|
||||
template: debian
|
||||
parameters:
|
||||
release: bullseye
|
||||
release: bookworm
|
||||
arch: amd64
|
||||
family: debian
|
||||
|
||||
@ -23,9 +23,8 @@ masters:
|
||||
template: download
|
||||
parameters:
|
||||
dist: alpine
|
||||
release: 3.14
|
||||
release: 3.21
|
||||
arch: amd64
|
||||
no-validate: true
|
||||
family: alpine
|
||||
|
||||
disabled-groups:
|
||||
|
||||
@ -11,8 +11,8 @@ hosts:
|
||||
interfaces:
|
||||
eth0:
|
||||
bridge: transit-a
|
||||
ipv4: 100.64.1.140/24
|
||||
ipv6: 2001:db8:b001::140/48
|
||||
ipv4: 100.64.0.140/24
|
||||
ipv6: 2001:db8:b000::140/48
|
||||
eth1:
|
||||
bridge: mica-lan
|
||||
ipv4: 100.82.0.1/16
|
||||
|
||||
@ -5,22 +5,36 @@ if [ -z $SNSTERGUARD ] ; then exit 1; fi
|
||||
DIR=`dirname $0`
|
||||
cd `dirname $0`
|
||||
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
DEB_VERSION=`cat /etc/debian_version | cut -d'.' -f1`
|
||||
if [ $DEB_VERSION -eq "11" ] # DEB 11 aka Bullseye
|
||||
then
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
fi
|
||||
|
||||
# manage mica.sns zone
|
||||
apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y unbound
|
||||
cp dns.conf /etc/unbound/unbound.conf.d/
|
||||
|
||||
# On place les certifs
|
||||
if [ -f tls/root_ca.crt ]; then
|
||||
cp -ar tls/root_ca.crt /usr/local/share/ca-certificates/
|
||||
/usr/sbin/update-ca-certificates --fresh
|
||||
fi
|
||||
|
||||
# Install smallstep CA / ACME server
|
||||
cd /tmp
|
||||
wget https://github.com/smallstep/cli/releases/download/v0.17.2/step-cli_0.17.2_amd64.deb
|
||||
dpkg -i step-cli_0.17.2_amd64.deb
|
||||
wget https://github.com/smallstep/certificates/releases/download/v0.17.2/step-ca_0.17.2_amd64.deb
|
||||
dpkg -i step-ca_0.17.2_amd64.deb
|
||||
wget "https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.24.4/step-cli_0.24.4_amd64.deb"
|
||||
dpkg -i step-cli_0.24.4_amd64.deb
|
||||
wget "https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.24.2/step-ca_0.24.2_amd64.deb"
|
||||
dpkg -i step-ca_0.24.2_amd64.deb
|
||||
|
||||
echo "password" > /root/ca-passwordfile
|
||||
step ca init --deployment-type=standalone --name="Kaz CA" --dns="ca.mica.sns" --acme --address=":443" --provisioner="contact@kaz.sns" --password-file="/root/ca-passwordfile" --root="${DIR}/tls/root_ca.crt" --key "${DIR}/tls/root_ca.key"
|
||||
echo -e '#!/bin/sh\nstep-ca --password-file /root/ca-passwordfile' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
|
||||
# step ca init
|
||||
# step ca root root.crt
|
||||
|
||||
@ -6,9 +6,13 @@ if [ -z $SNSTERGUARD ] ; then exit 1; fi
|
||||
DIR=`dirname $0`
|
||||
cd `dirname $0`
|
||||
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
DEB_VERSION=`cat /etc/debian_version | cut -d'.' -f1`
|
||||
if [ $DEB_VERSION -eq "11" ] # DEB 11 aka Bullseye
|
||||
then
|
||||
# disable systemd-resolved which conflicts with nsd
|
||||
echo "DNSStubListener=no" >> /etc/systemd/resolved.conf
|
||||
systemctl stop systemd-resolved
|
||||
fi
|
||||
|
||||
apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y nsd
|
||||
|
||||
@ -20,8 +20,8 @@ hosts:
|
||||
- bgprouter:
|
||||
asn: 30
|
||||
asdev: eth1
|
||||
neighbors4: 100.64.0.10 as 10;100.64.0.30 as 7;100.64.0.40 as 8; 100.64.0.20 as 6; 100.64.0.50 as 13; 100.64.0.110 as 20; 100.64.1.140 as 12
|
||||
neighbors6: 2001:db8:b000::10 as 10; 2001:db8:b000::30 as 7;2001:db8:b000::40 as 8; 2001:db8:b000::20 as 6; 2001:db8:b000::50 as 13; 2001:db8:b000::110 as 20; 2001:db8:b001::140 as 12
|
||||
neighbors4: 100.64.0.10 as 10;100.64.0.11 as 11;100.64.0.30 as 7;100.64.0.40 as 8; 100.64.0.20 as 6; 100.64.0.50 as 13; 100.64.0.110 as 20; 100.64.0.140 as 12
|
||||
neighbors6: 2001:db8:b000::10 as 10; 2001:db8:b000::11 as 11; 2001:db8:b000::30 as 7;2001:db8:b000::40 as 8; 2001:db8:b000::20 as 6; 2001:db8:b000::50 as 13; 2001:db8:b000::110 as 20; 2001:db8:b000::140 as 12
|
||||
- resolv:
|
||||
ns: 100.100.100.100
|
||||
domain: transit-a.sns
|
||||
|
||||
@ -20,8 +20,8 @@ touch /etc/network/keepdhcp
|
||||
|
||||
# Force lxc bridged interface metric (else, it grows to 200+interface_index, which can be large with successive stop/start)
|
||||
# This metric must be lower than the one exported by BGP for the default route (static part below)
|
||||
mkdir /etc/udhcpc
|
||||
echo "IF_METRIC=200" > /etc/udhcpc/udhcpc.conf
|
||||
mkdir -p /etc/udhcpc
|
||||
echo "IF_METRIC=200" >> /etc/udhcpc/udhcpc.conf
|
||||
|
||||
|
||||
# customize bird config (BGP)
|
||||
@ -38,3 +38,5 @@ protocol static {
|
||||
# Add dnsmasq for external dns
|
||||
apk add dnsmasq
|
||||
rc-update add dnsmasq
|
||||
# dnsmasq listen on eth1
|
||||
echo "interface=eth1" >> /etc/dnsmasq.conf
|
||||
|
||||
@ -1,20 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Installation de Kaz
|
||||
|
||||
if [ -z "${KAZGUARD}" ] ; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
snster -c /root/snster-kaz start
|
||||
sleep 10
|
||||
snster -c /root/snster-kaz attach kaz-prod -x /mnt/snster/root/snster-kaz/kaz/prod/kaz.sh
|
||||
|
||||
# On crée quelques mails
|
||||
SETUP_MAIL="docker exec mailServ setup"
|
||||
snster -c /root/snster-kaz attach kaz-prod -x "${SETUP_MAIL} email add contact1@kaz.sns toto"
|
||||
snster -c /root/snster-kaz attach kaz-prod -x "${SETUP_MAIL} email add contact2@kaz.sns toto"
|
||||
snster -c /root/snster-kaz attach kaz-prod -x "${SETUP_MAIL} email add contact3@kaz.sns toto"
|
||||
snster -c /root/snster-kaz attach kaz-prod -x "${SETUP_MAIL} email add contact4@kaz.sns toto"
|
||||
|
||||
echo -e '#!/bin/sh\nsnster -c /root/snster-kaz start' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
@ -15,49 +15,51 @@ mkdir -p "${VAGRANT_SRC_DIR}/log/"
|
||||
export DebugLog="${VAGRANT_SRC_DIR}/log/log-vagrant-$(date +%y-%m-%d-%T)-"
|
||||
(
|
||||
echo "########## ********** Start Vagrant $(date +%D-%T)"
|
||||
#pour la résolution de noms dans /etc/hosts
|
||||
SERVICES_LIST="smtp mail ldap www depot tableur pad webmail sondage garradin test-garradin wiki git agora cloud office cachet quotas"
|
||||
|
||||
# Copie de qques fichiers
|
||||
cp "${VAGRANT_SRC_DIR}/keyboard" /etc/default/keyboard
|
||||
|
||||
sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# MAJ et install
|
||||
# gestions sources.list
|
||||
sed -i -e 's/main.*/main contrib non-free/' /etc/apt/sources.list
|
||||
if [ -f "${VAGRANT_SRC_DIR}/.apt-mirror-config" ]; then
|
||||
# pour ceux qui disposent d'un cache apt local et pas la fibre
|
||||
# suffit d'indiquer "host:port" dans le fichier ".apt-mirror-config"
|
||||
. "${VAGRANT_SRC_DIR}/.apt-mirror-config"
|
||||
sed -i \
|
||||
-e "s%s\?://deb.debian.org%://${APT_MIRROR_DEBIAN}%g" \
|
||||
-e "s%s\?://security.debian.org%://${APT_MIRROR_DEBIAN_SECURITY}%g" \
|
||||
-e "s%s\?://archive.ubuntu.com%://${APT_MIRROR_UBUNTU}%g" \
|
||||
-e "s%s\?://security.ubuntu.com%://${APT_MIRROR_UBUNTU_SECURITY}%g" \
|
||||
/etc/apt/sources.list
|
||||
sed -i -e 's/https:/http:/' /etc/apt/sources.list
|
||||
apt-get --allow-releaseinfo-change update
|
||||
|
||||
# Cache APT
|
||||
#DEBIAN_FRONTEND=noninteractive apt-get install -y apt-cacher # apt-cacher-ng does not work well on bullseye
|
||||
#echo "allowed_hosts = *" >> /etc/apt-cacher/apt-cacher.conf
|
||||
#service apt-cacher restart
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y squid
|
||||
sed -i -e "s/#http_access allow localnet/http_access allow localnet/" /etc/squid/squid.conf
|
||||
echo "cache_dir aufs /var/spool/squid 5000 14 256
|
||||
maximum_object_size 4000 MB
|
||||
http_port 3142" >> /etc/squid/squid.conf
|
||||
service squid restart
|
||||
echo "Acquire::http::Proxy \"http://127.0.0.1:3142\";" > /etc/apt/apt.conf.d/01proxy; # utilisation de apt-cacher-ng
|
||||
# Ajouter http://www.squid-cache.org/Doc/config/cache_peer/ à squid pour un proxy upstream
|
||||
|
||||
# Pour le confort de chacun, un customVM.sh optionnel
|
||||
if [ -f "${VAGRANT_SRC_DIR}/customVM.sh" ]; then
|
||||
bash "${VAGRANT_SRC_DIR}/customVM.sh"
|
||||
fi
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get --allow-releaseinfo-change update
|
||||
# MAJ et Install
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y upgrade
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y dist-upgrade
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y apg curl git sudo unzip rsync firefox-esr tcpdump net-tools mousepad wireshark swapspace whois ldap-utils python3-lxc lxc python3-pygraphviz python3-pil python3-yaml imagemagick btrfs-progs # could be with --no-install-recommends
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y linux-headers-`dpkg --print-architecture` virtualbox-guest-additions-iso dkms apg curl git sudo unzip rsync firefox-esr tcpdump net-tools mousepad wireshark swapspace whois python3-lxc lxc python3-pygraphviz python3-pil python3-yaml imagemagick btrfs-progs docker-registry # could be with --no-install-recommends
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y xfce4 lightdm xfce4-terminal xserver-xorg gitk # needs to install recommends
|
||||
|
||||
# vbox guest utils
|
||||
#VERSION=`curl https://download.virtualbox.org/virtualbox/LATEST-STABLE.TXT`
|
||||
#curl https://download.virtualbox.org/virtualbox/$VERSION/VBoxGuestAdditions_$VERSION.iso -o /tmp/vbox.iso
|
||||
#mount -o loop /tmp/vbox.iso /mnt
|
||||
mount -o loop /usr/share/virtualbox/VBoxGuestAdditions.iso /mnt
|
||||
/mnt/VBoxLinuxAdditions.run || true # vboxsf module will fail to load before reboot, expected behavior
|
||||
/sbin/rcvboxadd quicksetup all || true
|
||||
umount /mnt
|
||||
|
||||
ssh-keygen -t rsa -b 4096 -N '' <<<$'\ny'
|
||||
rsync /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
|
||||
|
||||
# Pour le confort de chacun
|
||||
# Le fihcier .customDocker.sh contient
|
||||
# DEBIAN_FRONTEND=noninteractive apt-get install -y joe
|
||||
# DEBIAN_FRONTEND=noninteractive apt-get install -y emacs
|
||||
# DEBIAN_FRONTEND=noninteractive apt-get install -y vim
|
||||
if [ -f "${VAGRANT_SRC_DIR}/.customDocker.sh" ]; then
|
||||
chmod a+x "${VAGRANT_SRC_DIR}/.customDocker.sh"
|
||||
"${VAGRANT_SRC_DIR}/.customDocker.sh"
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# Localisation du $LANG, en par défaut, timezone Paris
|
||||
if [ -z "${HOSTLANG}" ] ; then
|
||||
HOSTLANG="en_US.UTF-8"
|
||||
@ -71,23 +73,18 @@ export DebugLog="${VAGRANT_SRC_DIR}/log/log-vagrant-$(date +%y-%m-%d-%T)-"
|
||||
dpkg-reconfigure --frontend=noninteractive locales || true # don't fail for a locales problem
|
||||
update-locale LANG=${HOSTLANG} || true # don't fail for a locales problem
|
||||
|
||||
|
||||
echo -e "\n #### create user\n"
|
||||
# Creation des utilisateurs
|
||||
echo -e "\n #### create user\n"
|
||||
usermod -p $(mkpasswd --method=sha-512 root) root
|
||||
useradd -m -s "/bin/bash" -p $(mkpasswd --method=sha-512 debian) debian || true # don't fail if user already exists
|
||||
|
||||
# augmentation de la taille de /run si lowmem
|
||||
#echo "tmpfs /run tmpfs nosuid,noexec,size=26M 0 0" >> /etc/fstab
|
||||
#mount -o remount /run
|
||||
|
||||
# Désactivation de la mise en veille de l'écran
|
||||
mkdir -p /etc/X11/xorg.conf.d/
|
||||
rsync -a "${VAGRANT_SRC_DIR}/10-monitor.conf" /etc/X11/xorg.conf.d/
|
||||
# mv /etc/xdg/autostart/light-locker.desktop /etc/xdg/autostart/light-locker.desktop.bak
|
||||
DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y light-locker
|
||||
|
||||
#faut virer exim, il fout la grouille avec le docker postfix
|
||||
#faut virer exim, inutile
|
||||
DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y exim4-base exim4-config exim4-daemon-light
|
||||
|
||||
#login ssh avec mot de passe
|
||||
@ -131,8 +128,8 @@ EOF
|
||||
echo -e "[Configuration]\nShortcutsNoMnemonics=TRUE" >> "${TERM_CFG}"
|
||||
fi
|
||||
|
||||
echo -e "\n #### set swapspace\n"
|
||||
# free swapspace at shutdown
|
||||
echo -e "\n #### set swapspace\n"
|
||||
sed -i -e 's/ExecStart=\/usr\/sbin\/swapspace/ExecStart=\/usr\/sbin\/swapspace\nExecStop=\/usr\/sbin\/swapspace -e/' /lib/systemd/system/swapspace.service
|
||||
systemctl daemon-reload
|
||||
|
||||
@ -146,31 +143,30 @@ SystemMaxFileSize=2M
|
||||
EOF
|
||||
fi
|
||||
|
||||
#***********DEBUT CERTIF*******************
|
||||
#*****************ATTENTION: MARCHE PAS (il faut accepter toutes les exceptions de sécurité
|
||||
# CA et certifs avec smallstep
|
||||
|
||||
echo -e "\n #### mkcert\n"
|
||||
# Récupérer mkcert et générer la CA
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y libnss3-tools
|
||||
echo -e "\n #### smallstep\n"
|
||||
cd /tmp
|
||||
wget "https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.24.4/step-cli_0.24.4_amd64.deb"
|
||||
dpkg -i step-cli_0.24.4_amd64.deb
|
||||
echo "password" > /root/ca-passwordfile
|
||||
step ca init --deployment-type=standalone --name="Kaz CA" --dns="ca.mica.sns" --acme --address=":443" --provisioner="contact@kaz.sns" --password-file="/root/ca-passwordfile"
|
||||
|
||||
mkdir -p /root/mkcert
|
||||
cd /root/mkcert
|
||||
if [ ! -f mkcert ]; then
|
||||
wget https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64 -O mkcert
|
||||
chmod +x mkcert
|
||||
mkdir -p /etc/letsencrypt/local/
|
||||
export CAROOT=/etc/letsencrypt/local/
|
||||
/root/mkcert/mkcert -install # CA dans /etc/letsencrypt/local/
|
||||
cd "${CAROOT}"
|
||||
/root/mkcert/mkcert "*.kaz.sns" # cert et clé dans /etc/letsencrypt/local/
|
||||
mkdir -p /root/tls
|
||||
cp /root/.step/certs/root_ca.crt /root/tls/root_ca.crt
|
||||
chmod 644 /root/tls/root_ca.crt
|
||||
cp /root/.step/secrets/root_ca_key /root/tls/root_ca.key
|
||||
step crypto change-pass /root/tls/root_ca.key --no-password --insecure --password-file="/root/ca-passwordfile" --force
|
||||
|
||||
mkdir -p /etc/letsencrypt/live/kaz.sns/
|
||||
ln -s ../../local/_wildcard.kaz.sns.pem /etc/letsencrypt/live/kaz.sns/fullchain.pem
|
||||
ln -s ../../local/_wildcard.kaz.sns-key.pem /etc/letsencrypt/live/kaz.sns/privkey.pem
|
||||
fi
|
||||
step certificate create "*.kaz.sns" /root/tls/wildcard.crt /root/tls/wildcard.key --profile leaf --ca /root/.step/certs/intermediate_ca.crt --ca-key /root/.step/secrets/intermediate_ca_key --ca-password-file /root/ca-passwordfile --bundle --force --no-password --insecure --not-after 20000h
|
||||
|
||||
|
||||
#***********FIN CERTIF*******************
|
||||
# Cache docker registry
|
||||
echo "proxy:
|
||||
remoteurl: https://registry-1.docker.io
|
||||
auth:
|
||||
none:
|
||||
" >> /etc/docker/registry/config.yml
|
||||
service docker-registry restart
|
||||
|
||||
# clear apt cache
|
||||
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
||||
@ -181,7 +177,7 @@ EOF
|
||||
git clone https://framagit.org/flesueur/snster.git
|
||||
cd snster
|
||||
# git checkout tags/v1.1.0
|
||||
git checkout fe59ef1f
|
||||
git checkout 34b7c57cb7480cb4b3a84d14a1a46b60d0eb5967
|
||||
./install.sh
|
||||
|
||||
# BTRFS avec hotfix sale de SNSTER
|
||||
@ -191,40 +187,35 @@ EOF
|
||||
mkfs.btrfs -f /root/btrfs.img
|
||||
echo "/root/btrfs.img /var/lib/lxc btrfs loop 0 0" >> /etc/fstab
|
||||
mount /var/lib/lxc
|
||||
#losetup -f /root/btrfs.img
|
||||
#mount /dev/loop0 /var/lib/lxc
|
||||
sed -i -e "s/template=self.template/template=self.template, bdevtype='btrfs'/" /usr/local/lib/python3.9/dist-packages/backends/LxcBackend.py
|
||||
sed -i -e "s/template=self.template/template=self.template, bdevtype='btrfs'/" /usr/local/lib/python3.11/dist-packages/backends/LxcBackend.py
|
||||
|
||||
# SNSTER KAZ
|
||||
# cp -ar ${VAGRANT_SRC_DIR}/templates /root
|
||||
cp -ar ${VAGRANT_SRC_DIR}/snster-kaz /root
|
||||
|
||||
# crypto keys
|
||||
cp -ar /etc/letsencrypt /root/snster-kaz/kaz/prod/
|
||||
cp -ar /etc/letsencrypt /root/snster-kaz/isp-a/home/
|
||||
cp -ar /root/tls /root/snster-kaz/hoster-a/kaz1/
|
||||
cp -ar /root/tls /root/snster-kaz/hoster-b/kaz2/
|
||||
cp -ar /root/tls /root/snster-kaz/isp-a/home/
|
||||
cp -ar /root/tls /root/snster-kaz/mica/infra/
|
||||
|
||||
# On monte le filesystem de kaz-prod dans le /kaz de la VM pour le dév (en nofail)
|
||||
# mkdir /kaz-prod /kaz
|
||||
# echo "overlay /kaz-prod overlay lowerdir=/var/lib/lxc/sr-masters-bullseye/rootfs,upperdir=/var/lib/lxc/kaz-kaz-prod/overlay/delta,workdir=/var/lib/lxc/kaz-kaz-prod/overlay/work,nofail 0 0" >> /etc/fstab
|
||||
# echo "/kaz-prod/kaz /kaz none bind,nofail 0 0" >> /etc/fstab
|
||||
ln -s /var/lib/lxc/kaz-kaz-prod/rootfs/ /kaz-prod
|
||||
ln -s /kaz-prod/kaz /kaz
|
||||
|
||||
# On lie le filesystem de kaz-prod dans le /kaz de la VM pour le dév
|
||||
ln -s /var/lib/lxc/kaz-hoster-a-kaz1/rootfs/ /kaz1-prod
|
||||
ln -s /var/lib/lxc/kaz-hoster-b-kaz2/rootfs/ /kaz2-prod
|
||||
ln -s /kaz-prod1/kaz /kaz
|
||||
|
||||
# On met le KAZGUARD pour la mise au point
|
||||
echo "export KAZGUARD='true'" >> /root/.bashrc
|
||||
|
||||
# Build SNSTER KAZ !
|
||||
snster -c /root/snster-kaz create
|
||||
cp "${VAGRANT_SRC_DIR}/vm-install-kaz.sh" /root/
|
||||
chmod +x /root/vm-install-kaz.sh
|
||||
# quelques détails
|
||||
cp "${VAGRANT_SRC_DIR}/vm-upgrade.sh" /root/
|
||||
chmod +x /root/vm-upgrade.sh
|
||||
if [ "${NOKAZ}" == "true" ]; then
|
||||
echo "on ne fait pas l'install de kaz sur kaz-prod"
|
||||
else
|
||||
echo "on installe kaz sur kaz-prod"
|
||||
bash "/root/vm-install-kaz.sh"
|
||||
fi
|
||||
|
||||
echo -e '#!/bin/sh\nsnster -c /root/snster-kaz start' >> /etc/rc.local
|
||||
chmod +x /etc/rc.local
|
||||
|
||||
# Build SNSTER KAZ !
|
||||
snster -c /root/snster-kaz create
|
||||
|
||||
echo "########## ********** End Vagrant $(date +%D-%T)"
|
||||
) > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
|
||||
@ -235,3 +226,14 @@ reboot
|
||||
# KAZPROD="snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x"
|
||||
# ${KAZPROD} "docker cp /etc/letsencrypt/local/rootCA.pem sympaServ:/usr/local/share/ca-certificates/rootCA.crt"
|
||||
# ${KAZPROD} "docker exec -it sympaServ update-ca-certificates"
|
||||
|
||||
# Interception https avec squid-openssl (nok pour dockerhub) :
|
||||
# http_port 3142 tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=/etc/letsencrypt/local/rootCA.pem tls-key=/etc/letsencrypt/local/rootCA-key.pem tls-dh=prime256v1:/etc/letsencrypt/local/dhparam.pem
|
||||
# sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB
|
||||
# sslcrtd_children 5
|
||||
# ssl_bump server-first all
|
||||
# ssl_bump stare all
|
||||
# sslproxy_cert_error deny all
|
||||
# refresh_pattern -i (/blobs/sha256) 1440 99% 10080 ignore-no-store ignore-private override-expire store-stale reload-into-ims
|
||||
# refresh_pattern -i (/images/sha256) 1440 99% 10080 ignore-no-store ignore-private override-expire store-stale reload-into-ims
|
||||
# refresh_pattern -i (/manifests/) 1440 99% 10080 ignore-no-store ignore-private override-expire store-stale reload-into-ims
|
||||
|
||||
@ -15,23 +15,29 @@ git pull
|
||||
sed -i -e "s/template=self.template/template=self.template, bdevtype='btrfs'/" /usr/local/lib/python3.9/dist-packages/backends/LxcBackend.py
|
||||
|
||||
# On récupère le dernier kaz-vagrant
|
||||
if [ -z "${KAZBRANCH}" ] ; then
|
||||
KAZBRANCH="master"
|
||||
fi
|
||||
cd /tmp
|
||||
git clone https://git.kaz.bzh/KAZ/kaz-vagrant.git || (cd kaz-vagrant && git pull)
|
||||
git clone https://git.kaz.bzh/KAZ/kaz-vagrant.git || (cd kaz-vagrant && git fetch && git switch "${KAZBRANCH}" && git pull)
|
||||
cd /tmp/kaz-vagrant
|
||||
git switch develop-snster
|
||||
git switch "${KAZBRANCH}"
|
||||
|
||||
# On écrase les anciens fichiers
|
||||
cp -ar /tmp/kaz-vagrant/files/snster-kaz /root/
|
||||
# crypto keys
|
||||
cp -ar /etc/letsencrypt /root/snster-kaz/kaz/prod/
|
||||
cp -ar /etc/letsencrypt /root/snster-kaz/isp-a/home/
|
||||
cp -ar /root/tls /root/snster-kaz/hoster-a/kaz1/
|
||||
cp -ar /root/tls /root/snster-kaz/hoster-b/kaz2/
|
||||
cp -ar /root/tls /root/snster-kaz/isp-a/home/
|
||||
cp -ar /root/tls /root/snster-kaz/mica/infra/
|
||||
|
||||
# On détruit et reconstruit tout sauf kaz-prod
|
||||
SNSTER="snster -c /root/snster-kaz"
|
||||
$SNSTER destroy isp-a-home
|
||||
$SNSTER destroy isp-a-infra
|
||||
$SNSTER destroy isp-a-router
|
||||
$SNSTER destroy kaz-router
|
||||
$SNSTER destroy hoster-a-router
|
||||
$SNSTER destroy hoster-b-router
|
||||
$SNSTER destroy mica-router
|
||||
$SNSTER destroy mica-infra
|
||||
$SNSTER destroy opendns-router
|
||||
|
||||
162
init.sh
162
init.sh
@ -1,162 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
### Personalisation de la VM
|
||||
|
||||
cd "$(dirname $0)"
|
||||
|
||||
BOLD='[1m'
|
||||
RED='[0;31m'
|
||||
GREEN='[0;32m'
|
||||
YELLOW='[0;33m'
|
||||
BLUE='[0;34m'
|
||||
MAGENTA='[0;35m'
|
||||
CYAN='[0;36m'
|
||||
NC='[0m' # No Color
|
||||
NL='
|
||||
'
|
||||
|
||||
mkdir -p ./files/kaz/log/ ./files/kaz/download/ ./files/kaz/git/
|
||||
chmod a+rxw ./files/kaz/log/ ./files/kaz/download/ ./files/kaz/git/
|
||||
|
||||
cp Vagrantfile.dist Vagrantfile
|
||||
|
||||
OLD_MEN=$(grep vb.memory Vagrantfile | sed -e 's%.*vb.memory\s*=\s*"\([^"]*\)".*%\1%')
|
||||
OLD_CUPS=$(grep vb.cpus Vagrantfile | sed -e 's%.*vb.cpus\s*=\s*"\([^"]*\)".*%\1%')
|
||||
MEM=$(expr $(head -1 /proc/meminfo | awk '{print $2}') / 4096)
|
||||
CUP=$(expr $(nproc) / 2)
|
||||
|
||||
cat <<EOF
|
||||
${GREEN}${BOLD}
|
||||
MEM: ${OLD_MEN} => ${MEM}
|
||||
CUP: ${OLD_CUPS} => ${CUP}
|
||||
${NC}
|
||||
Update './Vagrantfile'
|
||||
EOF
|
||||
|
||||
sed -i Vagrantfile \
|
||||
-e 's%vb.memory\s*=\s*"[^"]*"%vb.memory = "'${MEM}'"%' \
|
||||
-e 's%vb.cpus\s*=\s*"[^"]*"%vb.cpus = "'${CUP}'"%'
|
||||
|
||||
|
||||
APT_CONF="files/.apt-mirror-config"
|
||||
if [ -f "${APT_CONF}" ]; then
|
||||
. "${APT_CONF}"
|
||||
fi
|
||||
|
||||
### Personalisation d'un cache apt
|
||||
if [ -z "${APT_MIRROR_DEBIAN}" ]; then
|
||||
APT_MIRROR_DEBIAN=$(grep "deb\s.*/debian[^-]" /etc/apt/sources.list | head -1 | sed -e "s%.*deb\s.*://\([^/]*\)/debian.*%\1%")
|
||||
fi
|
||||
if [ -z "${APT_MIRROR_DEBIAN_SECURITY}" ]; then
|
||||
APT_MIRROR_DEBIAN_SECURITY=$(grep "deb\s.*/debian-security" /etc/apt/sources.list | head -1 | sed -e "s%.*deb\s.*://\([^/]*\)/debian-security.*%\1%")
|
||||
fi
|
||||
if [ -z "${APT_MIRROR_UBUNTU}" ]; then
|
||||
APT_MIRROR_UBUNTU=$(grep "deb\s.*://\([^/]*\)/ubuntu" /etc/apt/sources.list | head -1 | sed -e "s%.*deb\s.*://\([^/]*\)/ubuntu.*%\1%")
|
||||
fi
|
||||
if [ -z "${APT_MIRROR_UBUNTU_SECURITY}" ]; then
|
||||
APT_MIRROR_UBUNTU_SECURITY=$(grep "deb\s.*://\([^/]*\)/ubuntu.*-security" /etc/apt/sources.list | head -1 | sed -e "s%.*deb\s.*://\([^/]*\)/ubuntu.*%\1%")
|
||||
fi
|
||||
|
||||
if [ -z "${APT_MIRROR_UBUNTU}" ]; then
|
||||
APT_MIRROR_UBUNTU="${APT_MIRROR_DEBIAN}"
|
||||
fi
|
||||
if [ -z "${APT_MIRROR_UBUNTU_SECURITY}" ]; then
|
||||
APT_MIRROR_UBUNTU_SECURITY="${APT_MIRROR_DEBIAN_SECURITY}"
|
||||
fi
|
||||
|
||||
while : ; do
|
||||
cat <<EOF
|
||||
${GREEN}${BOLD}
|
||||
APT_MIRROR_DEBIAN=${APT_MIRROR_DEBIAN}
|
||||
APT_MIRROR_DEBIAN_SECURITY=${APT_MIRROR_DEBIAN_SECURITY}
|
||||
APT_MIRROR_UBUNTU=${APT_MIRROR_UBUNTU}
|
||||
APT_MIRROR_UBUNTU_SECURITY=${APT_MIRROR_UBUNTU_SECURITY}
|
||||
${NC}
|
||||
EOF
|
||||
|
||||
read -p "Update '${APT_CONF}' (ip:port or y/n)? [no] " proxy
|
||||
case "${proxy}" in
|
||||
*:* )
|
||||
APT_MIRROR_DEBIAN=${proxy}
|
||||
APT_MIRROR_DEBIAN_SECURITY=${proxy}
|
||||
APT_MIRROR_UBUNTU=${proxy}
|
||||
APT_MIRROR_UBUNTU_SECURITY=${proxy}
|
||||
;;
|
||||
[YyOo]* )
|
||||
cat > "${APT_CONF}" <<EOF
|
||||
# Generated by $(pwd)$(basename $0)
|
||||
# $(date "+%x %X")
|
||||
|
||||
APT_MIRROR_DEBIAN=${APT_MIRROR_DEBIAN}
|
||||
APT_MIRROR_DEBIAN_SECURITY=${APT_MIRROR_DEBIAN_SECURITY}
|
||||
APT_MIRROR_UBUNTU=${APT_MIRROR_UBUNTU}
|
||||
APT_MIRROR_UBUNTU_SECURITY=${APT_MIRROR_UBUNTU_SECURITY}
|
||||
EOF
|
||||
break;;
|
||||
""|[Nn]* ) break;;
|
||||
* ) echo "Please answer ip:port, yes or no.";;
|
||||
|
||||
esac
|
||||
done
|
||||
|
||||
|
||||
PROXY_CONF="files/.proxy-config"
|
||||
if [ -f "${PROXY_CONF}" ]; then
|
||||
FTP_PROXY=$(grep "ftp_proxy" "${PROXY_CONF}" | head -1 | sed -e "s%.*ftp_proxy\s*=\s*.*://\(.*\)%\1%")
|
||||
HTTP_PROXY=$(grep "http_proxy" "${PROXY_CONF}" | head -1 | sed -e "s%.*http_proxy\s*=\s*.*://\(.*\)%\1%")
|
||||
HTTPS_PROXY=$(grep "https_proxy" "${PROXY_CONF}" | head -1 | sed -e "s%.*https_proxy\s*=\s*.*://\(.*\)%\1%")
|
||||
fi
|
||||
|
||||
while : ; do
|
||||
cat <<EOF
|
||||
${GREEN}${BOLD}
|
||||
export ftp_proxy=ftp://${FTP_PROXY}
|
||||
export http_proxy=http://${HTTP_PROXY}
|
||||
export https_proxy=https://${HTTPS_PROXY}
|
||||
${NC}
|
||||
EOF
|
||||
read -p "proxy in '${PROXY_CONF}' (ip:port, yes or no)? [no] " proxy
|
||||
case "${proxy}" in
|
||||
*:* )
|
||||
FTP_PROXY=${proxy}
|
||||
HTTP_PROXY=${proxy}
|
||||
HTTPS_PROXY=${proxy}
|
||||
;;
|
||||
[yY]*|[Oo]* )
|
||||
cat > "${PROXY_CONF}" <<EOF
|
||||
# Generated by $(pwd)$(basename $0)
|
||||
# $(date "+%x %X")
|
||||
|
||||
export ftp_proxy=ftp://${FTP_PROXY}
|
||||
export http_proxy=http://${HTTP_PROXY}
|
||||
export https_proxy=https://${HTTPS_PROXY}
|
||||
EOF
|
||||
break;;
|
||||
""|[Nn]* ) break;;
|
||||
* ) echo "Please answer ip:port, yes or no.";;
|
||||
|
||||
esac
|
||||
done
|
||||
|
||||
CUSTOM_CONF=files/.customDocker.sh
|
||||
echo
|
||||
if [ -f "${CUSTOM_CONF}" ]; then
|
||||
OLD_EDITOR=$(grep install "${CUSTOM_CONF}" | grep "\(joe\|emacs\|vim\)" | head -1 | sed -e "s%.*\(joe\|emacs\|vim\).*%\1%")
|
||||
fi
|
||||
while : ; do
|
||||
read -p "Choose editor in '${CUSTOM_CONF}' (joe, emacs, vim or no)? [${GREEN}${BOLD}${OLD_EDITOR}${NC}] " editor
|
||||
case "${editor}" in
|
||||
joe|emacs|vim )
|
||||
if [ ! -f "${CUSTOM_CONF}" ]; then
|
||||
echo "#!/bin/bash" > "${CUSTOM_CONF}"
|
||||
fi
|
||||
chmod a+x "${CUSTOM_CONF}"
|
||||
if ! grep -qw "${editor}" "${CUSTOM_CONF}" 2> /dev/null ; then
|
||||
echo "DEBIAN_FRONTEND=noninteractive apt-get install -y ${editor}" >> "${CUSTOM_CONF}"
|
||||
echo "rsync -a /vagrant/files/.emacs* /root/" >> "${CUSTOM_CONF}"
|
||||
fi
|
||||
break;;
|
||||
""|[Nn]* ) break;;
|
||||
* ) echo "Please answer joe, emacs, vim or no.";;
|
||||
esac
|
||||
done
|
||||
Reference in New Issue
Block a user