Merge branch 'master' of code.ungleich.ch:ungleich-public/ungleich-tools
This commit is contained in:
Nico Schottelius
commit
ff3214e46a
|
|
@ -43,7 +43,7 @@ echo '* * * * * root ip -o -6 addr show | grep -E -v " lo |one" > /etc/issue' >
|
|||
|
||||
mkdir -p ${chroot_dir}/root/.ssh
|
||||
|
||||
for key in balazs dominique jinguk nico; do
|
||||
for key in fnux balazs dominique jinguk nico; do
|
||||
curl -s ${keyurl}/${key}.pub >> ${chroot_dir}/root/.ssh/authorized_keys
|
||||
done
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
#!/bin
|
||||
#!/bin/sh
|
||||
# Nico Schottelius, 2019-12-02
|
||||
# Update mikrotik routers to the latest package
|
||||
|
||||
|
|
|
|||
|
|
@ -20,15 +20,28 @@ if echo $to_monitor | grep ^osd; then
|
|||
depends="${depends}, ${to_monitor}-whoami"
|
||||
osd="yes"
|
||||
osdid=$(echo $to_monitor | cut -d. -f2)
|
||||
fi
|
||||
cat > "$conf" <<EOF
|
||||
# Generated by $0
|
||||
check process ${to_monitor} with pidfile /var/run/ceph/${to_monitor}.pid
|
||||
start program = "/usr/bin/ceph-osd -i ${osdid} --pid-file /var/run/ceph/osd.${osdid}.pid -c /etc/ceph/ceph.conf --cluster ceph --setuser ceph --setgroup ceph" with timeout 3600 seconds
|
||||
stop program = "/usr/bin/pkill -f '/usr/bin/ceph-osd -i ${osdid}'"
|
||||
EOF
|
||||
|
||||
|
||||
cat > "$conf" <<EOF
|
||||
else
|
||||
# monitor, mgr
|
||||
cat > "$conf" <<EOF
|
||||
# Generated by $0
|
||||
check process ${to_monitor} with pidfile /var/run/ceph/${to_monitor}.pid
|
||||
start program = "/etc/init.d/ceph start ${to_monitor}" with timeout 60 seconds
|
||||
stop program = "/etc/init.d/ceph stop ${to_monitor}"
|
||||
|
||||
EOF
|
||||
|
||||
fi
|
||||
|
||||
# final clause same for both
|
||||
cat >> "$conf" <<EOF
|
||||
|
||||
group ceph
|
||||
depends on $depends
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -0,0 +1,183 @@
|
|||
#!/bin/sh
|
||||
|
||||
# This script generates CentOS images for OpenNebula. Expected to run on CentOS 7.
|
||||
|
||||
# Depends on the following packages:
|
||||
# qemu-img util-linux coreutils dnf curl e2fsprogs cryptsetup parted
|
||||
|
||||
# Run locally (without network) with:
|
||||
# qemu-system-x86_64 -enable-kvm -m 1G -drive file=$IMAGE,format=raw
|
||||
|
||||
set -e
|
||||
set -x
|
||||
|
||||
RELEASE=7
|
||||
ARCH=x86_64
|
||||
IMAGE_PATH=centos-luks-$RELEASE-$(date --iso-8601).img
|
||||
IMAGE_SIZE=10G
|
||||
LOOPBACK_DEVICE=/dev/loop0
|
||||
LUKS_DEVICE_NAME=cryptroot
|
||||
LUKS_DEVICE="/dev/mapper/$LUKS_DEVICE_NAME"
|
||||
DISABLED_ONE_SCRIPTS="loc-20-set-username-password loc-22-ssh_public_key"
|
||||
|
||||
ONE_CONTEXT_RPM_URL="https://github.com/OpenNebula/addon-context-linux/releases/download/v5.10.0/one-context-5.10.0-1.el$RELEASE.noarch.rpm"
|
||||
ONE_CONTEXT_RPM_PATH=/root/one-context.rpm
|
||||
|
||||
# Get LUKS passphrase.
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: centos7-build-luks-opennebula-image.sh LUKS_PASSPHRASE"
|
||||
exit 1
|
||||
fi
|
||||
LUKS_PASSPHRASE="$1"
|
||||
|
||||
cleanup() {
|
||||
# The order here is important.
|
||||
umount /mnt/dev/pts 2>/dev/null || true
|
||||
umount /mnt/dev/shm 2>/dev/null || true
|
||||
umount /mnt/dev 2>/dev/null || true
|
||||
umount /mnt/proc 2>/dev/null || true
|
||||
umount /mnt/run 2>/dev/null || true
|
||||
umount /mnt/sys 2>/dev/null || true
|
||||
umount /mnt/boot 2>/dev/null || true
|
||||
umount /mnt 2>/dev/null || true
|
||||
losetup -d "$LOOPBACK_DEVICE"
|
||||
}
|
||||
|
||||
run_root() {
|
||||
chroot /mnt /usr/bin/env \
|
||||
PATH=/sbin:/usr/sbin:/bin:/usr/bin \
|
||||
sh -c "$*"
|
||||
}
|
||||
|
||||
if [ "$(whoami)" != 'root' ]; then
|
||||
echo "This script must be run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f '/etc/centos-release' ]; then
|
||||
echo "WARNING: this script has been designed to run on a CentOS system." >&2
|
||||
echo "WARNING: Not running CentOS. Giving you 5 seconds to abort." >&2
|
||||
sleep 5
|
||||
fi
|
||||
|
||||
# Install requirements
|
||||
yum install -y qemu cryptsetup dnf
|
||||
|
||||
# Create base RAW image (no LOOPBACK support in RHEL/CentOS).
|
||||
qemu-img create -f raw "$IMAGE_PATH" "$IMAGE_SIZE"
|
||||
losetup "$LOOPBACK_DEVICE" "$IMAGE_PATH"
|
||||
|
||||
# Don't forget to cleanup, even if the script crash.
|
||||
trap cleanup EXIT
|
||||
|
||||
# Create partition table, format partitions.
|
||||
parted --script "$LOOPBACK_DEVICE" \
|
||||
mklabel msdos \
|
||||
mkpart primary ext4 1M 500M \
|
||||
mkpart primary ext4 500M 100%
|
||||
|
||||
partprobe "$LOOPBACK_DEVICE"
|
||||
|
||||
mkfs.ext4 "${LOOPBACK_DEVICE}p1"
|
||||
echo -n "$LUKS_PASSPHRASE" | cryptsetup luksFormat -v -d - "${LOOPBACK_DEVICE}p2"
|
||||
echo -n "$LUKS_PASSPHRASE" | cryptsetup open -v -d - "${LOOPBACK_DEVICE}p2" "$LUKS_DEVICE_NAME"
|
||||
mkfs.ext4 "$LUKS_DEVICE"
|
||||
|
||||
# Mount partitions, install base OS.
|
||||
mount "${LUKS_DEVICE}" /mnt
|
||||
mkdir /mnt/boot
|
||||
mount "${LOOPBACK_DEVICE}p1" /mnt/boot
|
||||
|
||||
# Add --setopt=reposdir=rpm-repositories if you do not run on CentOS 7.
|
||||
dnf -y \
|
||||
--releasever=$RELEASE \
|
||||
--installroot=/mnt \
|
||||
--disablerepo='*' \
|
||||
--enablerepo=base \
|
||||
--enablerepo=extras \
|
||||
--setopt=install_weak_deps=False install \
|
||||
bash basesystem systemd dnf centos-release cryptsetup dnf
|
||||
|
||||
mount --bind /dev /mnt/dev
|
||||
mount --bind /dev/pts /mnt/dev/pts
|
||||
mount --bind /dev/shm /mnt/dev/shm
|
||||
mount --bind /proc /mnt/proc
|
||||
mount --bind /run /mnt/run
|
||||
mount --bind /sys /mnt/sys
|
||||
|
||||
# Guest networking is to be handled by the one-context package.
|
||||
# See https://github.com/OpenNebula/addon-context-linux for details.
|
||||
# Note: as of writing, one-context does not support NetworkManager or
|
||||
# systemd-networkd.
|
||||
|
||||
# Required to resolve package mirror in chroot.
|
||||
cp /etc/resolv.conf /mnt/etc/resolv.conf
|
||||
|
||||
# Initialize /etc/hosts.
|
||||
cat > /mnt/etc/hosts << EOF
|
||||
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||
EOF
|
||||
|
||||
# Install one-context RPM and hope things works as expected.
|
||||
curl -L "$ONE_CONTEXT_RPM_URL" > "/mnt$ONE_CONTEXT_RPM_PATH"
|
||||
run_root dnf -y install "$ONE_CONTEXT_RPM_PATH"
|
||||
run_root rm "$ONE_CONTEXT_RPM_PATH"
|
||||
for script in $DISABLED_ONE_SCRIPTS; do
|
||||
run_root rm "/etc/one-context.d/$script"
|
||||
done
|
||||
|
||||
# Install resize2fs, which is required to resize the root file-system.
|
||||
run_root dnf -y install e2fsprogs
|
||||
|
||||
# Initalize base services.
|
||||
run_root systemd-machine-id-setup
|
||||
run_root ln -sf /usr/share/zoneinfo/UTC /etc/localtime
|
||||
|
||||
# Install and configure NTP client.
|
||||
run_root dnf install -y chrony
|
||||
run_root systemctl enable chronyd.service
|
||||
|
||||
# Install kernel and bootloader.
|
||||
# Note: linux-firmware is not required our environment and takes almost 200M
|
||||
# uncompressed but is a direct dependency of kernel-core...
|
||||
run_root dnf -y install kernel grub2
|
||||
|
||||
# Add support for virtio block devices at boot time, configure bootloader.
|
||||
cat > /mnt/etc/dracut.conf.d/virtio-blk.conf <<EOF
|
||||
add_drivers="virtio-blk"
|
||||
EOF
|
||||
kernel_version=$(ls /mnt/boot | grep "vmlinuz.*.$ARCH" | cut -d- -f2-)
|
||||
luks_uuid=$(blkid -o value "${LOOPBACK_DEVICE}p2" | head -n 1)
|
||||
echo "cryptroot UUID=$luks_uuid luks,timeout=30" >> /mnt/etc/crypttab
|
||||
|
||||
run_root dracut -v --force --kver $kernel_version
|
||||
run_root grub2-install --target=i386-pc "${LOOPBACK_DEVICE}"
|
||||
run_root grub2-mkconfig -o /boot/grub2/grub.cfg
|
||||
|
||||
# Install en configure SSH daemon.
|
||||
run_root dnf -y install openssh-server
|
||||
run_root systemctl enable sshd
|
||||
|
||||
# Generate fstab file.
|
||||
boot_uuid=$(blkid -o value "${LOOPBACK_DEVICE}p1" | head -n 1)
|
||||
root_uuid=$(blkid -o value "$LUKS_DEVICE" | head -n 1)
|
||||
cat >>/mnt/etc/fstab <<EOF
|
||||
UUID=$boot_uuid /boot ext4 rw,relatime,data=ordered 0 2
|
||||
UUID=$root_uuid / ext4 rw,relatime,data=ordered 0 1
|
||||
EOF
|
||||
|
||||
# Reset systemd's environment.
|
||||
run_root rm -f /etc/machine-id
|
||||
run_root touch /etc/machine-id
|
||||
rm -f /var/lib/systemd/random-seed
|
||||
|
||||
# Remove temporary files and reclaim freed disk space.
|
||||
# Note: build logs could be removed as well.
|
||||
run_root dnf clean all
|
||||
|
||||
# Make sure everything is written to disk before exiting.
|
||||
sync
|
||||
|
||||
# Cleanup!
|
||||
cleanup
|
||||
|
|
@ -9,15 +9,13 @@ set -x
|
|||
# XXX: Handle command-line arguments?
|
||||
RELEASE=12.1-RELEASE
|
||||
ARCH=amd64
|
||||
IMAGE_PATH=freebsd-$RELEASE-$(date +%+F).img.qcow2
|
||||
IMAGE_PATH=freebsd-$RELEASE-$(date -I).img.qcow2
|
||||
IMAGE_SIZE=10G
|
||||
|
||||
DIST_BASE="https://download.freebsd.org/ftp/releases/$ARCH/$RELEASE"
|
||||
PORTS_BASE="https://download.freebsd.org/ftp/snapshots/$ARCH/12.1-STABLE"
|
||||
|
||||
# TODO: find the package definition and built ourself, publish in some RPM repository.
|
||||
ONE_CONTEXT_RPM_URL="https://github.com/OpenNebula/addon-context-linux/releases/download/v5.10.0/one-context-5.10.0-1.el8.noarch.rpm"
|
||||
ONE_CONTEXT_RPM_PATH=/root/one-context.rpm
|
||||
ONE_CONTEXT_PKG_URL="https://github.com/OpenNebula/addon-context-linux/releases/download/v5.12.0/one-context-5.12.0_1.txz"
|
||||
|
||||
cleanup() {
|
||||
sync || true
|
||||
|
|
@ -70,7 +68,7 @@ growfs_enable=YES
|
|||
hostname="freebsd"
|
||||
EOF
|
||||
|
||||
cp /etc/resolv.conf > /mnt/etc/resolv.conf
|
||||
cp /etc/resolv.conf /mnt/etc/resolv.conf
|
||||
tzsetup -s -C /mnt UTC
|
||||
|
||||
cat >>/mnt/etc/ssh/sshd_config <<EOF
|
||||
|
|
@ -98,7 +96,11 @@ then
|
|||
fi
|
||||
|
||||
env ASSUME_ALWAYS_YES=YES pkg -c /mnt bootstrap -f
|
||||
env ASSUME_ALWAYS_YES=YES pkg -c /mnt install bash
|
||||
env ASSUME_ALWAYS_YES=YES pkg -c /mnt install bash curl
|
||||
|
||||
curl -L "$ONE_CONTEXT_PKG_URL" -o /mnt/one-context.txz
|
||||
env ASSUME_ALWAYS_YES=YES pkg -c /mnt add one-context.txz
|
||||
rm /mnt/one-context.txz
|
||||
|
||||
fetch -m -o "$dist_dir/ports.txz" "$PORTS_BASE/ports.txz"
|
||||
tar -C /mnt -xJf "$dist_dir/ports.txz"
|
||||
|
|
@ -107,8 +109,8 @@ cleanup
|
|||
trap : EXIT
|
||||
|
||||
mkdir -p "$ARCH"
|
||||
qemu-img convert -f raw -O qcow2 $disk "$ARCH"/root.img.qcow2
|
||||
rm $disk
|
||||
qemu-img convert -f raw -O qcow2 "$disk" "$IMAGE_PATH"
|
||||
rm "$disk"
|
||||
|
||||
# Filesystem will be enlarged by growfs(7) on next startup
|
||||
qemu-img resize $IMAGE_PATH $IMAGE_SIZE
|
||||
qemu-img resize "$IMAGE_PATH" "$IMAGE_SIZE"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
[base]
|
||||
name=CentOS-$releasever - Base
|
||||
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
|
||||
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
|
||||
gpgcheck=0
|
||||
enabled=0
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
|
||||
|
||||
#released updates
|
||||
[updates]
|
||||
name=CentOS-$releasever - Updates
|
||||
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra
|
||||
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
|
||||
gpgcheck=0
|
||||
enabled=0
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
[extras]
|
||||
name=CentOS-$releasever - Extras
|
||||
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras&infra=$infra
|
||||
#baseurl=http://mirror.centos.org/$contentdir/$releasever/extras/$basearch/os/
|
||||
gpgcheck=0
|
||||
enabled=0
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
|
||||
|
|
@ -2,24 +2,33 @@
|
|||
# 2020-06-13, Nico Schottelius
|
||||
# See https://ungleich.ch/u/products/viirb-ipv6-box/
|
||||
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "$0 interface"
|
||||
if [ $# -lt 1 ]; then
|
||||
echo "$0 interface [address]"
|
||||
echo " interface to add the config ip address to"
|
||||
echo " address: connect to this address, ignore the interface"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
set -x
|
||||
dev=$1; shift
|
||||
|
||||
if [ $# -ge 1 ]; then
|
||||
viirb_ip=$1; shift
|
||||
dev=""
|
||||
else
|
||||
viirb_ip=192.168.61.1
|
||||
fi
|
||||
|
||||
# openwrt
|
||||
version=19.07.3
|
||||
filename=openwrt-${version}-ramips-mt76x8-vocore2-squashfs-sysupgrade.bin
|
||||
|
||||
# IP address for setting it up initially
|
||||
viirb_ip=192.168.61.1
|
||||
|
||||
sudo ip addr del 192.168.61.2/24 dev "$dev" 2>/dev/null || true
|
||||
sudo ip addr add 192.168.61.2/24 dev "$dev"
|
||||
if [ "$dev" ]; then
|
||||
sudo ip addr del 192.168.61.2/24 dev "$dev" 2>/dev/null || true
|
||||
sudo ip addr add 192.168.61.2/24 dev "$dev"
|
||||
fi
|
||||
|
||||
# don't care about other/old known_host entries
|
||||
ssh-keygen -R ${viirb_ip}
|
||||
|
|
|
|||
|
|
@ -215,5 +215,5 @@ uci commit
|
|||
reboot
|
||||
EOF
|
||||
|
||||
echo "Wireguard public key: ${public_key}"
|
||||
echo "Wireguard public key and id: ${id} ${public_key}"
|
||||
echo ${public_key} > ${viirb_hostname}.public_key
|
||||
|
|
|
|||
Loading…
Reference in New Issue