202 lines
5.7 KiB
Bash
Executable File
202 lines
5.7 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
ok () { echo "ok -- $@" >&2; }
|
|
not_ok () { echo "not ok -- $@" >&2; }
|
|
|
|
if ! test $UID -eq 0 ; then
|
|
not_ok "Correr con sudo!"
|
|
exit 1
|
|
fi
|
|
|
|
dir="`realpath $0 | xargs dirname`"
|
|
authorized_keys=/home/$SUDO_USER/.ssh/authorized_keys
|
|
|
|
if ! test -f $authorized_keys; then
|
|
not_ok "Primero usa ssh-copy-id desde tu computadora para copiar llaves SSH!"
|
|
exit 1
|
|
fi
|
|
|
|
if test `cat $authorized_keys | wc -l` -eq 0; then
|
|
not_ok "Tu archivo $authorized_keys está vacío, no será posible desbloquear la huerta luego"
|
|
exit 1
|
|
fi
|
|
|
|
if test -z "$1"; then
|
|
not_ok "El primer parámetro tiene que ser un disco completo sin particiones"
|
|
exit 1
|
|
fi
|
|
|
|
disk=$1
|
|
|
|
for part in ${disk}?; do
|
|
if test -b "$part"; then
|
|
not_ok "El disco ${disk} contiene particiones, la instalación destruirá datos"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
apt update
|
|
apt install -y dropbear-initramfs busybox-initramfs smartmontools git rsync make tinc dialog locales bash-completion gnutls-bin nano
|
|
|
|
if ! test -f /etc/modprobe.d/disable-algif.conf; then
|
|
ok "Proteger contra copy.fail"
|
|
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
|
|
fi
|
|
|
|
ok "No permitir suspensión"
|
|
sed -re "s/^#(HandleLidSwitch=).*/\1ignore/" \
|
|
-e "s/^#(HandleLidSwitchDocked=).*/\1ignore/" \
|
|
-e "s/^#(LidSwitchIgnoreInhibited=).*/\1no/" \
|
|
-i /etc/systemd/logind.conf
|
|
|
|
if ! test -d /root/rap; then
|
|
ok "Clonando repositorio RAP"
|
|
git clone https://git.coopcloud.tech/escuela-comun/rap /root/rap
|
|
fi
|
|
|
|
ok "Actualizando repositorio RAP"
|
|
git -C /root/rap pull
|
|
|
|
cd /root/rap
|
|
node_dir=/root/rap/networks/comun/$HOSTNAME
|
|
|
|
if ! test -d $node_dir ; then
|
|
ok "Iniciando nodo RAP"
|
|
NETWORK=comun ./rap init $HOSTNAME
|
|
fi
|
|
|
|
ok "Reparando la RAP"
|
|
sed -re "s/^..(:.*)$/02\1/" -i $node_dir/config/mac
|
|
rm -f $node_dir/hosts/abyayala*
|
|
|
|
NETWORK=comun ./rap add-host $HOSTNAME abyayala
|
|
NETWORK=comun ./rap install $HOSTNAME
|
|
|
|
if ! test -b /dev/mapper/dm_crypt-1 ; then
|
|
ok "Cifrando el disco, usa la misma contraseña de cifrado que usaste durante la instalación"
|
|
cryptsetup luksFormat $disk
|
|
fi
|
|
|
|
if ! test -b /dev/mapper/dm_crypt-1 ; then
|
|
ok "Abriendo el disco cifrado"
|
|
cryptsetup open $disk dm_crypt-1
|
|
fi
|
|
|
|
key_file=/etc/dm_crypt-1.key
|
|
|
|
if ! test -f "$key_file" ; then
|
|
ok "Creando archivo de contraseña"
|
|
dd bs=512 count=4 if=/dev/random iflag=fullblock | install -m 0600 /dev/stdin "$key_file"
|
|
|
|
ok "Asignando archivo de contraseña"
|
|
cryptsetup luksAddKey $disk /etc/dm_crypt-1.key
|
|
fi
|
|
|
|
if ! grep -q dm_crypt-1 /etc/crypttab ; then
|
|
uuid="`blkid $disk -o value -p | head -n2 | tail -n 1`"
|
|
|
|
ok "Agregando $uuid a /etc/crypttab"
|
|
echo "dm_crypt-1 UUID=$uuid /etc/dm_crypt-1.key luks" >> /etc/crypttab
|
|
fi
|
|
|
|
if ! test -d /var/lib/docker; then
|
|
ok "Creando directorio de datos de Docker"
|
|
mkdir -p /var/lib/docker
|
|
fi
|
|
|
|
if ! pvdisplay /dev/mapper/dm_crypt-1 &>/dev/null; then
|
|
ok "Creando el PV de LVM para el disco de datos"
|
|
pvcreate /dev/mapper/dm_crypt-1
|
|
fi
|
|
|
|
if ! vgdisplay data-vg &>/dev/null ; then
|
|
ok "Creando VG de LVM para el disco de datos"
|
|
vgcreate data-vg /dev/mapper/dm_crypt-1
|
|
fi
|
|
|
|
if ! lvdisplay /dev/data-vg/data-lv &>/dev/null ; then
|
|
ok "Creando LV de LVM para el disco de datos"
|
|
lvcreate -l 100%FREE data-vg -n data-lv
|
|
mkfs.xfs /dev/data-vg/data-lv
|
|
fi
|
|
|
|
if ! grep -q /var/lib/docker /etc/fstab ; then
|
|
ok "Agregando directorio de datos de Docker a fstab"
|
|
echo "/dev/data-vg/data-lv /var/lib/docker xfs defaults 0 1" >> /etc/fstab
|
|
fi
|
|
|
|
if ! grep -q IP=dhcp /etc/initramfs-tools/initramfs.conf; then
|
|
ok "Configurando DHCP durante el inicio"
|
|
echo IP=dhcp >> /etc/initramfs-tools/initramfs.conf
|
|
fi
|
|
|
|
default_interface="`ip route | grep default | cut -d " " -f 5`"
|
|
if ! grep -q DEVICE=$default_interface /etc/initramfs-tools/initramfs.conf; then
|
|
ok "Configurando interfaz de red para DHCP durante el inicio"
|
|
sed -re "s/^(#*)DEVICE=.*$/DEVICE=${default_interface}/" -i /etc/initramfs-tools/initramfs.conf
|
|
fi
|
|
|
|
ok "Configurando DHCP"
|
|
sed -re "s/#\s*(clientid)/\1/" -e "s/^(duid)/# \1/" -i /etc/dhcpcd.conf
|
|
if ! grep -q "denyinterfaces " /etc/dhcpcd.conf ; then
|
|
echo "denyinterfaces veth*" >> /etc/dhcpcd.conf
|
|
fi
|
|
|
|
if ! test -f /etc/dropbear/initramfs/authorized_keys; then
|
|
ln $authorized_keys /etc/dropbear/initramfs/authorized_keys
|
|
fi
|
|
|
|
ok "Copiando identificador de host de OpenSSH a Dropbear"
|
|
rm -f /etc/dropbear/initramfs/dropbear_*
|
|
|
|
dropbearconvert openssh dropbear /etc/ssh/ssh_host_rsa_key /etc/dropbear/initramfs/dropbear_rsa_host_key
|
|
dropbearconvert openssh dropbear /etc/ssh/ssh_host_ed25519_key /etc/dropbear/initramfs/dropbear_ed25519_host_key
|
|
dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/dropbear/initramfs/dropbear_ecdsa_host_key
|
|
|
|
ok "Sincronizando archivos de initramfs-tools"
|
|
rsync -av --chown 0:0 $dir/initramfs-tools/ /etc/initramfs-tools/
|
|
|
|
ok "Generando initramfs"
|
|
update-initramfs -u
|
|
|
|
if ! mount | grep -q /var/lib/docker ; then
|
|
ok "Montando almacenamiento docker"
|
|
mount /var/lib/docker
|
|
fi
|
|
|
|
ok "Configurando el idioma"
|
|
localectl set-locale LANG=es_AR.UTF-8
|
|
|
|
if ! which docker &>/dev/null; then
|
|
ok "Instalando Docker"
|
|
curl https://get.docker.com | bash
|
|
|
|
ok "Agregando $SUDO_USER al grupo Docker"
|
|
usermod -aG docker $SUDO_USER
|
|
fi
|
|
|
|
if ! docker network ls | grep -q swarm ; then
|
|
ok "Iniciando Swarm"
|
|
docker swarm init --advertise-addr 127.0.0.1
|
|
fi
|
|
|
|
if ! docker network ls | grep -q proxy ; then
|
|
ok "Creando red"
|
|
docker network create -d overlay proxy
|
|
fi
|
|
|
|
if ! grep -q https://hormuz.respaldos.abyaya.la /etc/docker/daemon.json ; then
|
|
ok "Configurando Docker"
|
|
|
|
echo '{"registry-mirrors":["https://hormuz.respaldos.abyaya.la"]}' >/etc/docker/daemon.json
|
|
systemctl restart docker
|
|
fi
|
|
|
|
if test -f /etc/ssh/ssh_config.d/keep_alive.conf; then
|
|
echo "ClientAliveInterval 60" >/etc/ssh/sshd_config.d/keep_alive.conf
|
|
/etc/ssh/ssh_config.d/keep_alive.conf
|
|
fi
|
|
|
|
ok "Ahora puedes reiniciar la huerta!"
|