You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
211 lines
8.5 KiB
211 lines
8.5 KiB
#!/bin/bash
|
|
|
|
if [ -z "${KAZGUARD}" ] ; then
|
|
exit 1
|
|
fi
|
|
|
|
resize2fs /dev/sda1
|
|
|
|
DIR=$(cd "$(dirname $0)"; pwd)
|
|
cd "${DIR}"
|
|
set -e
|
|
export VAGRANT_SRC_DIR=/vagrant/files
|
|
|
|
mkdir -p "${VAGRANT_SRC_DIR}/log/"
|
|
export DebugLog="${VAGRANT_SRC_DIR}/log/log-vagrant-$(date +%y-%m-%d-%T)-"
|
|
(
|
|
echo "########## ********** Start Vagrant $(date +%D-%T)"
|
|
#pour la résolution de noms dans /etc/hosts
|
|
SERVICES_LIST="smtp mail ldap www depot tableur pad webmail sondage garradin test-garradin wiki git agora cloud office cachet quotas"
|
|
|
|
# Copie de qques fichiers
|
|
cp "${VAGRANT_SRC_DIR}/keyboard" /etc/default/keyboard
|
|
|
|
sysctl -w net.ipv4.ip_forward=1
|
|
|
|
# MAJ et install
|
|
sed -i -e 's/main.*/main contrib non-free/' /etc/apt/sources.list
|
|
if [ -f "${VAGRANT_SRC_DIR}/.apt-mirror-config" ]; then
|
|
# pour ceux qui disposent d'un cache apt local et pas la fibre
|
|
# suffit d'indiquer "host:port" dans le fichier ".apt-mirror-config"
|
|
. "${VAGRANT_SRC_DIR}/.apt-mirror-config"
|
|
sed -i \
|
|
-e "s%s\?://deb.debian.org%://${APT_MIRROR_DEBIAN}%g" \
|
|
-e "s%s\?://security.debian.org%://${APT_MIRROR_DEBIAN_SECURITY}%g" \
|
|
-e "s%s\?://archive.ubuntu.com%://${APT_MIRROR_UBUNTU}%g" \
|
|
-e "s%s\?://security.ubuntu.com%://${APT_MIRROR_UBUNTU_SECURITY}%g" \
|
|
/etc/apt/sources.list
|
|
fi
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get --allow-releaseinfo-change update
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y upgrade
|
|
DEBIAN_FRONTEND=noninteractive apt-get -y dist-upgrade
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y apg curl git sudo unzip rsync firefox-esr tcpdump net-tools mousepad wireshark swapspace whois ldap-utils python3-lxc lxc python3-pygraphviz python3-pil python3-yaml imagemagick # could be with --no-install-recommends
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y xfce4 lightdm xfce4-terminal xserver-xorg gitk # needs to install recommends
|
|
|
|
ssh-keygen -t rsa -b 4096 -N '' <<<$'\ny'
|
|
rsync /root/.ssh/id_rsa.pub /root/.ssh/authorized_keys
|
|
|
|
# Pour le confort de chacun
|
|
# Le fihcier .customDocker.sh contient
|
|
# DEBIAN_FRONTEND=noninteractive apt-get install -y joe
|
|
# DEBIAN_FRONTEND=noninteractive apt-get install -y emacs
|
|
# DEBIAN_FRONTEND=noninteractive apt-get install -y vim
|
|
if [ -f "${VAGRANT_SRC_DIR}/.customDocker.sh" ]; then
|
|
chmod a+x "${VAGRANT_SRC_DIR}/.customDocker.sh"
|
|
"${VAGRANT_SRC_DIR}/.customDocker.sh"
|
|
fi
|
|
|
|
|
|
|
|
# Localisation du $LANG, en par défaut, timezone Paris
|
|
if [ -z "${HOSTLANG}" ] ; then
|
|
HOSTLANG="en_US.UTF-8"
|
|
fi
|
|
echo "Europe/Paris" > /etc/timezone
|
|
ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime
|
|
dpkg-reconfigure -f noninteractive tzdata
|
|
sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
|
|
sed -i -e "s/# ${HOSTLANG} /${HOSTLANG} /" /etc/locale.gen
|
|
echo "LANG=\"${HOSTLANG}\"">/etc/default/locale
|
|
dpkg-reconfigure --frontend=noninteractive locales || true # don't fail for a locales problem
|
|
update-locale LANG=${HOSTLANG} || true # don't fail for a locales problem
|
|
|
|
|
|
echo -e "\n #### create user\n"
|
|
# Creation des utilisateurs
|
|
usermod -p $(mkpasswd --method=sha-512 root) root
|
|
useradd -m -s "/bin/bash" -p $(mkpasswd --method=sha-512 debian) debian || true # don't fail if user already exists
|
|
|
|
# augmentation de la taille de /run si lowmem
|
|
#echo "tmpfs /run tmpfs nosuid,noexec,size=26M 0 0" >> /etc/fstab
|
|
#mount -o remount /run
|
|
|
|
# Désactivation de la mise en veille de l'écran
|
|
mkdir -p /etc/X11/xorg.conf.d/
|
|
rsync -a "${VAGRANT_SRC_DIR}/10-monitor.conf" /etc/X11/xorg.conf.d/
|
|
# mv /etc/xdg/autostart/light-locker.desktop /etc/xdg/autostart/light-locker.desktop.bak
|
|
DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y light-locker
|
|
|
|
#faut virer exim, il fout la grouille avec le docker postfix
|
|
DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y exim4-base exim4-config exim4-daemon-light
|
|
|
|
#login ssh avec mot de passe
|
|
sed -i "s/PasswordAuthentication no/PasswordAuthentication yes/" /etc/ssh/sshd_config
|
|
if ! grep -q "PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then
|
|
echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
|
|
fi
|
|
|
|
# autorisation du routing et augmentation inotify
|
|
if ! grep -q "net.ipv4.ip_forward" /etc/sysctl.conf 2>/dev/null; then
|
|
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
|
|
fi
|
|
sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/" /etc/sysctl.conf
|
|
if ! grep -q "fs.inotify.max_queued_events" /etc/sysctl.conf 2>/dev/null; then
|
|
echo -e "fs.inotify.max_queued_events=1048576\nfs.inotify.max_user_instances=1048576\nfs.inotify.max_user_watches=1048576" >> /etc/sysctl.conf
|
|
fi
|
|
sysctl -p
|
|
|
|
|
|
# enable bash autocompletion
|
|
cat >> /etc/bash.bashrc <<EOF
|
|
# enable bash completion in interactive shells
|
|
if ! shopt -oq posix; then
|
|
if [ -f /usr/share/bash-completion/bash_completion ]; then
|
|
. /usr/share/bash-completion/bash_completion
|
|
elif [ -f /etc/bash_completion ]; then
|
|
. /etc/bash_completion
|
|
fi
|
|
fi
|
|
EOF
|
|
|
|
# XFCE4 panel: use default config
|
|
# source: https://forum.xfce.org/viewtopic.php?pid=36585#p36585
|
|
rsync -a /etc/xdg/xfce4/panel/default.xml /etc/xdg/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml
|
|
|
|
# Permetre l'édition emacs des lignes de commande (exemple "Esc. flèche gauche" pour "déplace d'un mot à gauche")
|
|
TERM_CFG=/root/.config/xfce4/terminal/terminalrc
|
|
mkdir -p $(dirname "${TERM_CFG}")
|
|
touch "${TERM_CFG}"
|
|
if ! grep -q "ShortcutsNoMnemonics" "${TERM_CFG}" 2>/dev/null; then
|
|
echo -e "[Configuration]\nShortcutsNoMnemonics=TRUE" >> "${TERM_CFG}"
|
|
fi
|
|
|
|
echo -e "\n #### set swapspace\n"
|
|
# free swapspace at shutdown
|
|
sed -i -e 's/ExecStart=\/usr\/sbin\/swapspace/ExecStart=\/usr\/sbin\/swapspace\nExecStop=\/usr\/sbin\/swapspace -e/' /lib/systemd/system/swapspace.service
|
|
systemctl daemon-reload
|
|
|
|
# limit journald log size
|
|
mkdir -p /etc/systemd/journald.conf.d
|
|
if [ ! -f /etc/systemd/journald.conf.d/sizelimit.conf ]; then
|
|
cat > /etc/systemd/journald.conf.d/sizelimit.conf <<EOF
|
|
[Journal]
|
|
SystemMaxUse=20M
|
|
SystemMaxFileSize=2M
|
|
EOF
|
|
fi
|
|
|
|
#***********DEBUT CERTIF*******************
|
|
#*****************ATTENTION: MARCHE PAS (il faut accepter toutes les exceptions de sécurité
|
|
|
|
echo -e "\n #### mkcert\n"
|
|
# Récupérer mkcert et générer la CA
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y libnss3-tools
|
|
|
|
mkdir -p /root/mkcert
|
|
cd /root/mkcert
|
|
if [ ! -f mkcert ]; then
|
|
wget https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64 -O mkcert
|
|
chmod +x mkcert
|
|
mkdir -p /etc/letsencrypt/local/
|
|
export CAROOT=/etc/letsencrypt/local/
|
|
/root/mkcert/mkcert -install # CA dans /etc/letsencrypt/local/
|
|
cd "${CAROOT}"
|
|
/root/mkcert/mkcert "*.kaz.sns" # cert et clé dans /etc/letsencrypt/local/
|
|
|
|
mkdir -p /etc/letsencrypt/live/kaz.sns/
|
|
ln -s ../../local/_wildcard.kaz.sns.pem /etc/letsencrypt/live/kaz.sns/fullchain.pem
|
|
ln -s ../../local/_wildcard.kaz.sns-key.pem /etc/letsencrypt/live/kaz.sns/privkey.pem
|
|
fi
|
|
|
|
|
|
#***********FIN CERTIF*******************
|
|
|
|
# clear apt cache
|
|
DEBIAN_FRONTEND=noninteractive apt-get autoremove -y
|
|
DEBIAN_FRONTEND=noninteractive apt-get clean
|
|
|
|
# SNSTER
|
|
cd
|
|
git clone https://framagit.org/flesueur/snster.git
|
|
cd snster
|
|
./install.sh
|
|
|
|
# SNSTER KAZ
|
|
cp -ar ${VAGRANT_SRC_DIR}/templates /root
|
|
cp -ar ${VAGRANT_SRC_DIR}/snster-kaz /root
|
|
|
|
# crypto keys
|
|
cp -ar /etc/letsencrypt /root/snster-kaz/kaz/prod/
|
|
cp -ar /etc/letsencrypt /root/snster-kaz/isp-a/home/
|
|
|
|
# Build SNSTER KAZ !
|
|
snster -c /root/snster-kaz -t /root/templates create
|
|
snster -c /root/snster-kaz -t /root/templates start
|
|
snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x /mnt/snster/root/snster-kaz/kaz/prod/kaz.sh
|
|
|
|
# On crée quelques mails
|
|
SETUP_MAIL="docker exec mailServ setup"
|
|
snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x "${SETUP_MAIL} email add contact1@kaz.sns toto"
|
|
snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x "${SETUP_MAIL} email add contact2@kaz.sns toto"
|
|
snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x "${SETUP_MAIL} email add contact3@kaz.sns toto"
|
|
snster -c /root/snster-kaz -t /root/templates attach kaz-prod -x "${SETUP_MAIL} email add contact4@kaz.sns toto"
|
|
|
|
echo -e '#!/bin/sh\nsnster -c /root/snster-kaz start' >> /etc/rc.local
|
|
chmod +x /etc/rc.local
|
|
|
|
echo "########## ********** End Vagrant $(date +%D-%T)"
|
|
) > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
|
|
|
|
reboot
|
|
|