Skip to content

Commit a606b70

Browse files
jasoncolburnejasoncolburne
committed
add scripts
1 parent 41566cc commit a606b70

12 files changed

+429
-42
lines changed

‎src/core-switch/patch/keystone.conf.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
--- /etc/keystone/keystone.conf.sample 2022-05-30 07:01:55.016379255 -0300
2+
+++ /etc/keystone/keystone.conf 2022-05-30 07:50:14.820486765 -0300
3+
@@ -41,13 +41,13 @@
4+
# is set by default. In larger deployments, it is recommended that you set this
5+
# to a reasonable number to prevent operations like listing all users and
6+
# projects from placing an unnecessary load on the system. (integer value)
7+
-#list_limit = <None>
8+
+list_limit = 100
9+
10+
# If set to true, strict password length checking is performed for password
11+
# manipulation. If a password exceeds the maximum length, the operation will
12+
# fail with an HTTP 403 Forbidden error. If set to false, passwords are
13+
# automatically truncated to the maximum length. (boolean value)
14+
-#strict_password_check = false
15+
+strict_password_check = true
16+
17+
# If set to true, then the server will return information in HTTP responses
18+
# that may allow an unauthenticated or authenticated user to get more
19+
@@ -663,7 +663,7 @@
20+
# Deprecated group/name - [DEFAULT]/sql_connection
21+
# Deprecated group/name - [DATABASE]/sql_connection
22+
# Deprecated group/name - [sql]/connection
23+
-#connection = <None>
24+
+connection = postgresql+psycopg2:///keystone
25+
26+
# The SQLAlchemy connection string to use to connect to the slave database.
27+
# (string value)

‎src/core-switch/scripts/deploy-ldap.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/usr/bin/bash
2+
3+
set -euo pipefail
4+
5+
OLD_PWD=$(pwd)
6+
7+
echo "ensure ~/ldap-admin-passphrase.txt and ~/ldap-admin-passphrase-verify.txt exist and match"
8+
if [[ ! -f ~/ldap-admin-passphrase.txt ]]; then
9+
echo " ie:"
10+
echo " $ echo -n \"passphrase\" > ~/ldap-admin-passphrase.txt"
11+
exit 1
12+
fi
13+
sha256sum ~/ldap-admin-passphrase.txt | sed s/passphrase/passphrase-verify/ | sha256sum -c --quiet
14+
15+
sudo apt-get -y install slapd ldap-utils
16+
17+
ADMIN_PASSPHRASE=$(cat ~/ldap-admin-passphrase.txt)
18+
echo "configuring ldap basedn, users and groups"
19+
sudo ldapadd -x -D cn=admin,dc=homelab -w $ADMIN_PASSPHRASE -f ~/install/ldap/basedn.ldif
20+
sudo ldapadd -x -D cn=admin,dc=homelab -w $ADMIN_PASSPHRASE -f ~/install/ldap/ldap-users.ldif
21+
sudo ldapadd -x -D cn=admin,dc=homelab -w $ADMIN_PASSPHRASE -f ~/install/ldap/ldap-groups.ldif
22+
echo "deleting ~/ldap-admin-passphrase.txt to ensure security"
23+
rm ~/ldap-admin-passphrase.txt ~/ldap-admin-passphrase-verify.txt
24+
echo "generating ldap server key/cert"
25+
echo -n passphrase > passphrase.tmp
26+
sudo openssl genrsa -aes128 -out /etc/ssl/private/ldap_server.key -passout file:passphrase.tmp 4096
27+
sudo openssl rsa -in /etc/ssl/private/ldap_server.key -out /etc/ssl/private/ldap_server.key -passin file:passphrase.tmp
28+
rm passphrase.tmp
29+
sudo openssl req -new -days 3650 -key /etc/ssl/private/ldap_server.key -out /etc/ssl/private/ldap_server.csr
30+
sudo openssl x509 -in /etc/ssl/private/ldap_server.csr -out /etc/ssl/private/ldap_server.crt -req -signkey /etc/ssl/private/ldap_server.key -days 3650
31+
sudo cp /etc/ssl/private/ldap_server.{key,crt} /etc/ssl/certs/ca-certificates.crt /etc/ldap/sasl2/
32+
sudo chown -R openldap:openldap /etc/ldap/sasl2
33+
echo "installing ldap tls/sasl"
34+
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ~/install/ldap/ldapssl.ldif
35+
sudo echo "TLS_REQCERT allow" >> /etc/ldap/ldap.conf
36+
echo "disabling anonymous ldap binding"
37+
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ~/install/ldap/disableanonymous.ldif
38+
echo "disabling cleartexty ldap binding"
39+
sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ~/install/ldap/disablecleartextbind.ldif
40+
41+
echo "restarting slapd"
42+
sudo systemctl restart slapd
43+
44+
cd $OLD_PWD

‎src/core-switch/scripts/deploy-openstack-yoga-service.sh‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
#!/usr/bin/bash
2+
3+
set -euxo pipefail
4+
5+
OLD_PWD=$(pwd)
6+
7+
sudo ~/install/scripts/install-dependencies/$SERVICE.sh
8+
9+
sudo mkdir -p \
10+
/etc/$SERVICE \
11+
/var/lib/$SERVICE/venv \
12+
/var/lib/$SERVICE/src \
13+
/var/lib/$SERVICE/patch \
14+
/var/log/$SERVICE \
15+
/run/uwsgi/$SERVICE
16+
17+
mkdir -p ~/src/openstack
18+
19+
cd ~/src/openstack
20+
[[ -d $SERVICE ]] || git clone https://opendev.org/openstack/$SERVICE.git -b stable/yoga
21+
22+
sudo rm -rf /var/lib/$SERVICE/src/$SERVICE
23+
sudo cp -R ~/src/openstack/$SERVICE /var/lib/$SERVICE/src
24+
sudo cp -R ~/install/patch/$SERVICE* /var/lib/$SERVICE/patch
25+
26+
# this is actually flawed but we won't see a problem
27+
if rg -qF $SERVICE /etc/passwd
28+
then
29+
echo "skipping user $SERVICE creation"
30+
else
31+
sudo useradd \
32+
--home-dir "/var/lib/$SERVICE" \
33+
--create-home \
34+
--system \
35+
--shell /bin/false \
36+
$SERVICE
37+
fi
38+
39+
echo "SELECT 'CREATE DATABASE $SERVICE' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$SERVICE')\gexec" | sudo -u postgres psql -q
40+
sudo -u postgres psql -q << PLPGSQL
41+
DO
42+
\$do\$
43+
BEGIN
44+
IF NOT EXISTS (
45+
SELECT FROM pg_catalog.pg_roles
46+
WHERE rolname = '$SERVICE') THEN
47+
48+
CREATE ROLE $SERVICE LOGIN;
49+
END IF;
50+
END
51+
\$do\$;
52+
PLPGSQL
53+
sudo -u postgres psql -q -c "GRANT ALL PRIVILEGES ON DATABASE $SERVICE TO $SERVICE;"
54+
55+
sudo chown -R $SERVICE:$SERVICE /etc/$SERVICE
56+
sudo chown -R $SERVICE:$SERVICE /var/lib/$SERVICE
57+
sudo chown -R $SERVICE:$SERVICE /var/log/$SERVICE
58+
59+
if [[ $SERVICE_ADMIN_PORT != disabled ]]
60+
then
61+
HOST=$(hostname)
62+
SERVICE_ADMIN_PASSPHRASE=$(dd if=/dev/urandom bs=32 count=1 | base64)
63+
cat > ~/.openrc-admin << EOF
64+
export OS_PROJECT_DOMAIN_NAME=Default
65+
export OS_USER_DOMAIN_NAME=Default
66+
export OS_PROJECT_NAME=admin
67+
export OS_USERNAME=admin
68+
export OS_PASSWORD=$SERVICE_ADMIN_PASSPHRASE
69+
export OS_AUTH_URL=http://$HOST:35357/v3
70+
export OS_IDENTITY_API_VERSION=3
71+
export OS_IMAGE_API_VERSION=2
72+
EOF
73+
else
74+
# gross
75+
SERVICE_ADMIN_PASSPHRASE=
76+
fi
77+
78+
sudo -u $SERVICE SERVICE=$SERVICE SERVICE_PORT=$SERVICE_PORT SERVICE_ADMIN_PASSPHRASE=$SERVICE_ADMIN_PASSPHRASE ~/install/scripts/install-openstack-yoga-service.sh
79+
80+
# prepare for uwsgi and nginx configuration
81+
82+
sudo usermod -G www-data $SERVICE
83+
84+
sudo systemctl stop nginx
85+
sudo rm -f /etc/nginx/sites-enabled/default
86+
87+
sudo mkdir /var/log/nginx/$SERVICE
88+
sudo chown www-data:www-data /var/log/nginx/$SERVICE
89+
sudo mkdir /var/www/$SERVICE
90+
91+
# uwsgi
92+
93+
if [[ $SERVICE_ADMIN_PORT != disabled ]]
94+
then
95+
sudo bash -c "cat > /etc/uwsgi/apps-available/$SERVICE-admin.ini" << EOF
96+
[uwsgi]
97+
master = true
98+
plugin = python3
99+
thunder-lock = true
100+
processes = 5
101+
threads = 2
102+
chmod-socket = 660
103+
chown-socket = $SERVICE:www-data
104+
105+
name = $SERVICE
106+
uid = $SERVICE
107+
gid = www-data
108+
109+
chdir = /var/www/$SERVICE/
110+
virtualenv = /var/lib/$SERVICE/venv
111+
wsgi-file = /var/lib/$SERVICE/venv/bin/$SERVICE-wsgi-admin
112+
113+
no-orphans = true
114+
vacuum = true
115+
EOF
116+
117+
sudo ln -s /etc/uwsgi/apps-{available,enabled}/$SERVICE-admin.ini
118+
fi
119+
120+
sudo bash -c "cat > /etc/uwsgi/apps-available/$SERVICE.ini" << EOF
121+
[uwsgi]
122+
master = true
123+
plugin = python3
124+
thunder-lock = true
125+
processes = 3
126+
threads = 2
127+
chmod-socket = 660
128+
chown-socket = $SERVICE:www-data
129+
130+
name = $SERVICE
131+
uid = $SERVICE
132+
gid = www-data
133+
134+
chdir = /var/www/$SERVICE/
135+
virtualenv = /var/lib/$SERVICE/venv
136+
wsgi-file = /var/lib/$SERVICE/venv/bin/$SERVICE-wsgi-public
137+
138+
no-orphans = true
139+
vacuum = true
140+
EOF
141+
142+
sudo ln -s /etc/uwsgi/apps-{available,enabled}/$SERVICE.ini
143+
144+
sudo systemctl restart uwsgi
145+
146+
# nginx
147+
148+
sudo bash -c "cat > /etc/nginx/sites-available/$SERVICE.conf" << EOF
149+
server {
150+
listen $SERVICE_PORT;
151+
access_log /var/log/nginx/$SERVICE/access.log;
152+
error_log /var/log/nginx/$SERVICE/error.log;
153+
154+
location / {
155+
uwsgi_pass unix:///run/uwsgi/app/$SERVICE/socket;
156+
include uwsgi_params;
157+
}
158+
}
159+
EOF
160+
161+
[[ $SERVICE_ADMIN_PORT == disabled ]] || sudo bash -c "cat >> /etc/nginx/sites-available/$SERVICE.conf" << EOF
162+
server {
163+
listen $SERVICE_ADMIN_PORT;
164+
access_log /var/log/nginx/$SERVICE/access.log;
165+
error_log /var/log/nginx/$SERVICE/error.log;
166+
167+
location / {
168+
uwsgi_pass unix:///run/uwsgi/app/$SERVICE-admin/socket;
169+
include uwsgi_params;
170+
}
171+
}
172+
EOF
173+
174+
sudo ln -s /etc/nginx/sites-{available,enabled}/$SERVICE.conf
175+
sudo sed -i "s/worker_processes auto/worker_processes 6/" /etc/nginx/nginx.conf
176+
177+
sudo systemctl restart nginx
178+
179+
# cleanup
180+
181+
sudo rm -rf /var/lib/$SERVICE/src
182+
sudo rm -rf /var/lib/$SERVICE/patch
183+
184+
cd $OLD_PWD

‎src/core-switch/scripts/deploy-openstack-yoga.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/usr/bin/bash
2+
3+
set -euxo pipefail
4+
5+
SERVICE=keystone SERVICE_PORT=5000 SERVICE_ADMIN_PORT=35357 ~/install/scripts/deploy-openstack-yoga-service.sh

‎src/core-switch/scripts/install-dependencies/keystone.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/bash
2+
3+
set -euo pipefail
4+
5+
apt-get -y install \
6+
python3-pip \
7+
python3-venv \
8+
python3-dev \
9+
memcached \
10+
postgresql \
11+
libpq-dev \
12+
nginx \
13+
uwsgi \
14+
uwsgi-plugin-python3 \
15+
libldap2-dev \
16+
libsasl2-dev \
17+
python3-openstackclient

‎src/core-switch/scripts/install-openstack-yoga-service.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/bash
2+
3+
set -euxo pipefail
4+
5+
OLD_PWD=$(pwd)
6+
7+
cd ~/src/$SERVICE
8+
git switch -c debian-bullseye
9+
10+
tox -e genconfig
11+
tox -e genpolicy
12+
# tox -e docs
13+
# tox -e protection
14+
15+
cp -R etc/* /etc/$SERVICE
16+
patch -o /etc/$SERVICE/$SERVICE.conf /etc/$SERVICE/$SERVICE.conf.sample < ~/patch/$SERVICE.conf.patch
17+
18+
python3 -m venv /var/lib/$SERVICE/venv
19+
. /var/lib/$SERVICE/venv/bin/activate
20+
21+
pip install -r requirements.txt
22+
# requirements for our setup
23+
pip install psycopg2
24+
python3 setup.py install
25+
26+
$SERVICE-manage db_sync
27+
$SERVICE-manage fernet_setup
28+
$SERVICE-manage credential_setup
29+
30+
# this is very keystone specific and will need to be abstracted
31+
$SERVICE-manage bootstrap \
32+
--bootstrap-password $SERVICE_ADMIN_PASSPHRASE \
33+
--bootstrap-admin-url http://$(hostname):$SERVICE_PORT/v3/ \
34+
--bootstrap-internal-url http://$(hostname):$SERVICE_PORT/v3/ \
35+
--bootstrap-public-url http://$(hostname):$SERVICE_PORT/v3/ \
36+
--bootstrap-region-id RegionOne
37+
38+
deactivate
39+
40+
cd $OLD_PWD

‎src/core-switch/scripts/provision-for-package-development.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/bash
2+
3+
sudo apt-get -y install build-essential fakeroot devscripts ripgrep
4+
if rg -q 'debian unstable main' /etc/apt/sources.list
5+
then
6+
echo "found unstable sources, continuing"
7+
else
8+
echo "did not find unstable sources, patching sources.list"
9+
sudo sh -c "echo >> /etc/apt/sources.list"
10+
sudo sh -c "echo 'deb-src http://httpredir.debian.org/debian unstable main' >> /etc/apt/sources.list"
11+
fi
12+
sudo apt-get update

‎src/core-switch/scripts/provision.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/usr/bin/bash
2+
3+
set -euo pipefail
4+
5+
OLD_PWD=$(pwd)
6+
7+
echo "removing cd-rom from apt sources"
8+
sudo cp ~/install/sources.list /etc/apt/
9+
echo "upgrading operating system"
10+
sudo apt update
11+
sudo apt upgrade
12+
echo "installing required packages"
13+
sudo apt -y install \
14+
unzip \
15+
net-tools \
16+
bridge-utils \
17+
# clevis-tpm2 clevis-luks clevis-dracut
18+
19+
echo "installing optional packages"
20+
sudo apt -y install zsh git ripgrep && chsh -s $(which zsh) || true
21+
22+
echo
23+
24+
echo "deploying user config for $USER"
25+
cd ~
26+
unzip install/ssh.zip
27+
28+
echo "deploying system config"
29+
cd /
30+
31+
sudo systemctl stop networking
32+
echo "installing amd firmware"
33+
sudo unzip ~/install/amd.zip
34+
echo "deploying new networking configuration"
35+
sudo unzip -o ~/install/networking.zip
36+
echo "deploying new sshd configuration"
37+
sudo unzip -o ~/install/sshd.zip
38+
echo "deploying new grub configuration"
39+
sudo unzip -o ~/install/grub.zip
40+
sudo systemctl start networking
41+
echo "updating boot images"
42+
sudo update-initramfs -c -k all
43+
echo "updating grub"
44+
sudo update-grub
45+
46+
echo "installing sme kernel"
47+
cd ~
48+
unzip install/kernel.zip
49+
cd 5.10.0-14-sme-amd64
50+
sudo apt install ./linux-image-sme-amd64_5.10.113-1_amd64.deb ./linux-image-5.10.0-14-sme-amd64_5.10.113-1_amd64.deb
51+
52+
cd ~
53+
rm -rf 5.10.0-14-sme-amd64
54+
55+
echo "disabling iscsi"
56+
sudo systemctl --now disable iscsid.service
57+
58+
echo "to complete provisioning, reboot now."
59+
60+
cd $OLD_PWD

0 commit comments

Comments
 (0)