diff --git a/conf/type/__jail/.gitignore b/conf/type/__jail/.gitignore new file mode 100644 index 00000000..e0471be4 --- /dev/null +++ b/conf/type/__jail/.gitignore @@ -0,0 +1 @@ +files/jailbase.tgz diff --git a/conf/type/__jail/explorer/basepresent b/conf/type/__jail/explorer/basepresent new file mode 100755 index 00000000..f167a19c --- /dev/null +++ b/conf/type/__jail/explorer/basepresent @@ -0,0 +1,54 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# See if the jailbase.tgz or $jaildir/base dir exists +# + +# Debug +#exec >&2 +#set -x + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi + +name="base:jailbase.tgz" +out="" + +save_IFS="$IFS" +IFS=":" +for cur in $name; do + if [ -e "${jaildir}/$cur" ]; then + out="${out}:${cur}" + fi +done +IFS="$save_IFS" + +if [ -z "$out" ]; then + echo "NONE" +else + echo "${out}" +fi + +# Debug +#set +x + diff --git a/conf/type/__jail/explorer/present b/conf/type/__jail/explorer/present new file mode 100755 index 00000000..2ba3b2af --- /dev/null +++ b/conf/type/__jail/explorer/present @@ -0,0 +1,43 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# See if the requested jail exists +# + +# Debug +#exec >&2 +#set -x + +if [ -f "$__object/parameter/name" ]; then + name="$(cat "$__object/parameter/name")" +else + name=$__object_id +fi + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi + +[ -d "${jaildir}/$name" ] && echo "EXISTS" || echo "NOTEXIST" + +#set +x + diff --git a/conf/type/__jail/explorer/status b/conf/type/__jail/explorer/status new file mode 100755 index 00000000..fe81eaf7 --- /dev/null +++ b/conf/type/__jail/explorer/status @@ -0,0 +1,52 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# See if the requested jail is started +# + +# Debug +#exec >&2 +#set -x + +if [ -f "$__object/parameter/name" ]; then + name="$(cat "$__object/parameter/name")" +else + name="$__object_id" +fi + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi +# backslash-escaped $jaildir +sjaildir="$(echo ${jaildir} | sed 's#/#\\/#g')" + +jls_output="$(jls | grep "[ ^I]${sjaildir}\/${name}\$")" || true + +if [ -n "${jls_output}" ]; then + echo "STARTED" +else + echo "NOTSTART" +fi + +# Debug +#set +x + diff --git a/conf/type/__jail/gencode-local b/conf/type/__jail/gencode-local new file mode 100755 index 00000000..6292d943 --- /dev/null +++ b/conf/type/__jail/gencode-local @@ -0,0 +1,39 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# The __jail type creates, configures, and deletes FreeBSD jails for use as +# virtual machines. +# + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi + +jailbase="$(cat "$__object/parameter/jailbase")" + +remotebase="${jaildir}/jailbase.tgz" +basepresent="$(cat "$__object/explorer/basepresent")" + +if [ "$basepresent" = "NONE" ]; then + echo "$__remote_copy" "${jailbase}" "$__target_host:${remotebase}" +fi + diff --git a/conf/type/__jail/gencode-remote b/conf/type/__jail/gencode-remote new file mode 100755 index 00000000..7ebe26eb --- /dev/null +++ b/conf/type/__jail/gencode-remote @@ -0,0 +1,349 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# The __jail type creates, configures, and deletes FreeBSD jails for use as +# virtual machines. +# + +# Debug +#exec >&2 +#set -x + +if [ -f "$__object/parameter/name" ]; then + name="$(cat "$__object/parameter/name")" +else + name="$__object_id" +fi + +state="$(cat "$__object/parameter/state")" + +if [ -f "$__object/parameter/started" ]; then + started="$(cat "$__object/parameter/started")" +else + if [ ! "$state" = "present" ]; then + started="false" + else + started="true" + fi +fi + +if [ -f "$__object/parameter/ip" ]; then + ip="$(cat "$__object/parameter/ip")" +else +# IP is an optional param when $state=absent, but +# when $state=present, it's required. Enforce this. + if [ "$state" = "present" ]; then + exec >&2 + echo "If --state is 'present,' --ip must be given\!" + exit 1 + fi +fi + +if [ -f "$__object/parameter/hostname" ]; then + hostname="$(cat "$__object/parameter/hostname")" +else + hostname="$name" +fi + +if [ -f "$__object/parameter/interface" ]; then + interface="$(cat "$__object/parameter/interface")" +fi + +if [ -f "$__object/parameter/devfs-enable" ]; then + devfsenable="$(cat "$__object/parameter/devfs-enable")" +else + devfsenable="true" +fi + +if [ -f "$__object/parameter/devfs-ruleset" ]; then + devfsruleset="$(cat "$__object/parameter/devfs-ruleset")" +else + devfsruleset="jailrules" +fi + +# devfs_ruleset being defined without devfs_enable being true +# is pointless. Treat this as an error. +if [ -n "$devfsruleset" -a "$devfsenable" = "false" ]; then + exec >&2 + echo "Can't have --devfs-ruleset defined without --devfs-enable true." + exit 1 +fi + +if [ -f "$__object/parameter/onboot" ]; then + onboot="$(cat "$__object/parameter/onboot")" +fi + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi + +present="$(cat "$__object/explorer/present")" +status="$(cat "$__object/explorer/status")" + +# Defining a jail as absent and started at the same time +# makes no sense. Treat this as an error. +if [ "$started" = "true" -a "$state" = "absent" ]; then + exec >&2 + echo "Can't have --state absent and --started true together\!" + exit 1 +fi + +stopJail() { +# Check $status before issuing command + if [ "$status" = "STARTED" ]; then + echo "/etc/rc.d/jail stop ${name}" + fi +} + +startJail() { +# Check $status before issuing command + if [ "$status" = "NOTSTART" ]; then + echo "/etc/rc.d/jail start ${name}" + fi +} + +deleteJail() { +# Unmount the jail's mountpoints if necessary + cat <=1 rw mount is mounted still + for DIR in "${output}"; do + umount -F "/etc/fstab.${name}" "\$(echo "${DIR}" | awk '{print $3}')" + done + fi + output="\$(mount | grep "\/${name} (")" || true + if [ -n "\${output}" ]; then # ro mount is mounted still + umount -F "/etc/fstab.${name}" "\$(echo "${output}" | awk '{print $3}')" + fi +EOF +# Remove the jail's rw mountpoints + echo "rm -rf \"${jaildir}/rw/${name}\"" +# Remove the jail directory + echo "rm -rf \"${jaildir}/${name}\"" +# Remove the jail's fstab + echo "rm -f \"/etc/fstab.${name}\"" +# Remove jail_$name_* lines from rc.conf + cat </etc/fstab.${name} <>/etc/rc.conf + elif [ ! "\$(echo \$jail_enable | tr '[a-z]' '[A-Z]')" = "YES" ]; then # jail_enable="NO" + sed -i '.bak' 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf # fix this -^ + rm -f /etc/rc.conf.bak + fi + cat >>/etc/rc.conf <>/etc/rc.conf <>/etc/rc.conf <>/etc/rc.conf <&- >&- + # add default ruleset + cat >>/etc/devfs.rules <>/etc/rc.conf + else + jail_list="\${jail_list} ${name}" + sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf + rm -f /etc/rc.conf.bak + fi + unset jail_list +EOF +fi + +# Add the normal entries into the jail's rc.conf +cat <"${jaildir}/rw/${name}/etc/rc.conf" +echo sshd_enable=\"YES\" >>"${jaildir}/rw/${name}/etc/rc.conf" +echo sendmail_enable=\"NONE\" >>"${jaildir}/rw/${name}/etc/rc.conf" +echo syslogd_enable=\"YES\" >>"${jaildir}/rw/${name}/etc/rc.conf" +echo syslogd_flags=\"-ss\" >>"${jaildir}/rw/${name}/etc/rc.conf" + +EOF +# Configure SSHd's listening address +cat < + + +NAME +---- +cdist-type__jail - Manage FreeBSD jails + + +DESCRIPTION +----------- +This type is used on FreeBSD to manage jails. + + +REQUIRED PARAMETERS +------------------- +state:: + Either "present" or "absent." + +jailbase:: + The location of the .tgz archive containing the base fs for your jails. + + +OPTIONAL PARAMETERS +------------------- +name:: + The name of the jail. Default is to use the object_id as the jail name. + +started:: + Either "true" or "false." Defaults to true. + +ip:: + The ifconfig style IP/netmask combination to use for the jail guest. If + the state parameter is "present," this parameter is required. + +hostname:: + The FQDN to use for the jail guest. Defaults to the name parameter. + +interface:: + The name of the physical interface on the jail server to bind the jail to. + Defaults to the first interface found in the output of ifconfig -l. + +devfs-enable:: + Whether to allow devfs mounting within the jail. Must be "true" or "false." + Defaults to true. + +devfs-ruleset:: + The name of the devfs ruleset to associate with the jail. Defaults to + "jailrules." This ruleset must be copied to the server via another type. + To use this option, devfs-enable must be "true." + +onboot:: + Whether to add the jail to rc.conf's jail_list variable. Must be either + "true" or "false." Defaults to false. + +jaildir:: + The location on the remote server to use for hosting jail filesystems. + Defaults to /usr/jail. + + +CAVEATS +------- +This type does not currently support modification of jail options. If, for +example a jail needs to have its IP address or netmask changed, the jail must +be removed then re-added with the correct IP address/netmask or the appropriate +line (jail__ip="...") modified within rc.conf through some alternate +means. + +EXAMPLES +-------- + +-------------------------------------------------------------------------------- +# Create a jail called www +__jail www --state present --ip "192.168.1.2" --jailbase /my/jail/base.tgz + +# Remove the jail called www +__jail www --state absent --jailbase /my/jail/base.tgz + +# Ensure that the jail called www is started +__jail www --state present --started true \ + --ip "192.168.1.2 netmask 255.255.255.0" \ + --jailbase /my/jail/base.tgz + +# Use the name variable explicitly +__jail thisjail --state present --name www \ + --ip "192.168.1.2" \ + --jailbase /my/jail/base.tgz + +# Go nuts +__jail lotsofoptions --state present --name testjail --started true \ + --ip "192.168.1.100 netmask 255.255.255.0" \ + --hostname "testjail.example.com" --interface "em0" \ + --onboot yes --jailbase /my/jail/base.tgz --jaildir /jails +-------------------------------------------------------------------------------- + + +SEE ALSO +-------- +- cdist-type(7) + + +COPYING +------- +Copyright \(C) 2012 Jake Guffey. Free use of this software is +granted under the terms of the GNU General Public License version 3 (GPLv3). diff --git a/conf/type/__jail/manifest b/conf/type/__jail/manifest new file mode 100755 index 00000000..b2ecf2bc --- /dev/null +++ b/conf/type/__jail/manifest @@ -0,0 +1,46 @@ +#!/bin/sh +# +# 2012 Jake Guffey (jake.guffey at eprotex.com) +# +# This file is part of cdist. +# +# cdist is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# cdist is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with cdist. If not, see . +# +# +# The __jail type creates, configures, and deletes FreeBSD jails for use as +# virtual machines. +# + +# Debug +#exec >&2 +#set -x + +# Can only be used on FreeBSD +os="$(cat "$__global/explorer/os")" +if [ ! "$os" = "freebsd" ]; then + echo "__jail can only be used on FreeBSD targets!" >&2 + exit 1 +fi + +if [ -f "$__object/parameter/jaildir" ]; then + jaildir="$(cat "$__object/parameter/name")" +else + jaildir="/usr/jail" +fi + +__directory ${jaildir} --parents yes + +# Debug +#set +x + diff --git a/conf/type/__jail/parameter/optional b/conf/type/__jail/parameter/optional new file mode 100644 index 00000000..53b8895f --- /dev/null +++ b/conf/type/__jail/parameter/optional @@ -0,0 +1,9 @@ +name +started +ip +hostname +interface +devfs-enable +devfs-ruleset +onboot +jaildir diff --git a/conf/type/__jail/parameter/required b/conf/type/__jail/parameter/required new file mode 100644 index 00000000..29797ee6 --- /dev/null +++ b/conf/type/__jail/parameter/required @@ -0,0 +1,2 @@ +state +jailbase