From ebd00ff587a608b0e0d85b402a3e19138f8eed6c Mon Sep 17 00:00:00 2001 From: Adrian Amaglio Date: Wed, 20 Dec 2023 18:06:09 +0100 Subject: [PATCH] binary update --- .../roles/deploy_all/files/bin/deploy_as | Bin 0 -> 16608 bytes .../deploy_all/files/bin/deploy_service.sh | 41 ++++++++++++------ .../roles/deploy_all/files/bin/deploy_user.sh | 26 +++++++++++ .../roles/deploy_all/files/bin/deployall.sh | 19 +++++--- .../roles/deploy_all/files/bin/findcert.sh | 2 +- .../roles/deploy_all/files/bin/gen_env.sh | 1 + .../roles/deploy_all/files/bin/init.sh | 13 ++++++ .../files/bin/rclone_ncloud_publiclink.sh | 31 +++++++++++++ services/services.txt | 25 ++++++----- 9 files changed, 127 insertions(+), 31 deletions(-) create mode 100755 provisioning/roles/deploy_all/files/bin/deploy_as create mode 100755 provisioning/roles/deploy_all/files/bin/deploy_user.sh create mode 100755 provisioning/roles/deploy_all/files/bin/init.sh create mode 100755 provisioning/roles/deploy_all/files/bin/rclone_ncloud_publiclink.sh diff --git a/provisioning/roles/deploy_all/files/bin/deploy_as b/provisioning/roles/deploy_all/files/bin/deploy_as new file mode 100755 index 0000000000000000000000000000000000000000..a956e217520b9eeea1f7b33196d271d893bf1597 GIT binary patch literal 16608 zcmeHPeQ;FO6~7yZ1O&2tDIZlHRs>74ArL5_(dA>|#fA?9si4xwX7?po-R#EQw~)}H zu_@KenigmJVP|Xy+Rli!o#NP9?9>`WMVx+w=}g68I!!xRlMyv8+D40Pf9Jk?o-fa= zo$2(CwzGHU<#*5To^$Sf=ic}BzW46UJ)yewB|e|vG)CMYNa~+rGeK3LtyCF6P^=J> z@OQ4bQd|OgtmN$SpbaRs)9I3tSf=jF1?;b}h=zi|cGN!ANyb+WM*${delyqU?h6Y(HMCvuVM|_1z3R z)kR9<fhDqHYL|wC z#?*#Q4FYa@iBn+|C7rg+{-|uaDkuG44E}QI*fajWf9=7xyT5+8@^|mo-?xQysNG~k zI+VyC4-t|nKNSb**zvd*Ih!LqW&XC6uuz(T0PQ zWJ)xfR@VyhOIiPA_7x_tHFn34DNLF*N3Z*kXbu7R(ut@eEmQ1;5TuZl!}KGH$4`cM0d*X zD>*YehF^>^;>Sw`@#PLH#EUMT#|9Pmxp+0@ zaak3!#RwE5P>et^0>udYe@5VZ`IYbMUFXX5Z0ReNLg@Q@t&)77-t}DBae2b|Wvf8v z^7F3)l+P8U-$Et1!9VBo`2$j>2~BSBlq1tbBR6==k!fO+8+_c6X~K~kJmknU(Z~%x z=*Tp|$PM1>$TYFY4c_I*G@-~1h8>wENV&nA9hoK;xxv+rOcRRSV3i}&L?Smhk7bhpT{U-YiCLtD0ms(PzV>OD1&qg(Pbehzl@+@0QA(n2S)EH%@M2|wq{^x zJV|*Bjq&;Z^0}R)cU&R#PfGn|&k|gFQSTnokG*-Ler$M*?t4K$bnVv$+Ypm)_YQdaMN)tabhYnmVo?6{cE4@A*fFO=?t?Ar-jr+%^@+=D{O zG{6pnS<}1s4d~g>fZly#;0v(UyF z&xVFi9(O$6d#)EHdiT>h>WS*vvGW&7IW%0=t7rEUOEvA4xPLoARzfy79sDfmQ4xL+ zD?t1T9w^F(Fc!&pEV!=Wd}blI9?4M~RjJ*^LmzM(Uqeps*}qFxNP4#^FW*H0x`~|V zj+2C4Xgj&xaq>OnvisZNqpLr-zgN~g%`w{OHd^2qwK_)g#gGs+qEiT2-7C1p^loa) z0=MNG7r4z!VR?th|BRwl*E8u+=-2g>P9^1@(#g{17;=}&+_T6{k~#8NE_14<=D-hb zPksv44Jh2@RGgDJrDmbxflBMoQ#N`Z5WQ~i>AvywMqvTq2R;5 z--_Y15X0&8iO^Z*~b~Uyi$J=njmS zS%~Bnw$Z?NNB^FW>c7TuJ9%8*E9Gy8^J_sNDW+lsiV-MApcsK-1d0(TMxYph|KvgGm#dpDHb|MQP?YhwV4SMZOpRL=tY4etw>$h%e_}neqcig(TYRS^-Wy?RaVr8Jh5SetiS+-BR z9w)dv7BMUEz0AB}f>;xdYKqc`qJH(w8FO77kX}jjznRZ>0(;-e=MMw>fW5$jL-~9Q zu>0+N{xt9ma2WXV`FwsRCjV{kWK_Z_J5^h?W9XeYSALQEk6Q%2IUv1?OZKap$l`iD@;2~0c8gaet^0>uavBT$S$F#^R1{0~Hc z*NO4EFg3lGYtyLt6Zss}WE>x(WV-$`8)qq**PqQ%GCgNdnr(yNb!fa!n#4Eu6&_G{P~j1Uy$bsj_A4Ax=&ko($z?%XW5e3DtF(m; zjhTd%(WQ^619#DbTl)^ONX!_Le zCBiTK?nRB@G{px!{8Gj9bq7(VTKx6ls__SHSq)P`tE_$EGUqz7ONIC%GE{G`$N&9O ze}=Ozl=UA$X0-MfI*(3jAEo|G=lW#+ zJTjhBl0|+5WHi14yvD{Zqz{Ukz+EcnB9W~HKboIg!TX`__vnX7zhsKw`yP91F5qWx z0sb43_lr3ca3uLo0{B<~{infGd%W#`set~Ul>d|J)JTCqFoqam;oe+wyf&NrjT&`}|^4$ygO6A8J z|Lc_g5v4ER!$3bMdAlz6->n7srULvP@N~Z3db_}DZpSMBodSN26yTpPz`qRss!{ys zNWTQXzTW%f)=0{#3M8>0J=_>GtZ=gcfp>>ZO@WB`aPhifwHgsxzMh6=G-)))la1lH z5w()3v=Pp=aH-?PRrga8Z&ad0CY4yh1wV<(g#0crCR9{ywj16_0*Q~BHHm_g5 zHMGsxwt7un2o~O51VLv}Ki2Gfwg)(6w6_1_7WC5|gptZ-G;D>1JZ-f(VPv^y%Yjo^ zEmE1pR{Is~I{C`E74cF#5*#hr9)qf|HxW2H97bqh+d~7kL3nl>&?{<34Lcdoqv@p4 z5>7;EXF}~}c#Osp^r9Q4W+EzfV-p6dqHPO}>9nd)ZoshjSvbz9Rra2V5ftsQ7(o~Y zc0+Iv(l&`v_deKrIYt=rhK>=W+yyd%8M%98WDyN6Ap+@+R=ko2S}7Y_IES4dW~xmD z@F~CyG$%3vyoql!Q&xwIYRts2M+%{}wN|gGt)Od1s<+Vl`9QQIfhugYQg+F1GnJ-2 zCsIub2Fg-qJWK{E*A}-#KsGagY@j&_kuqsBA_A7#4v{V}Yov(8*efO83;5CV{}#&0evQ)W zSN4qjyhiP(n0e!O2pq+P&(HbYRKK76TnZJLy#4<$Shu~V>=^rPGv_b=EHgghvBxCI zP6}C%9k9%J#AEMgJB590sF3X#pYquAzG%kVJSWU{?DiRtJBk^gFAWae-(w3aqx3Czt7

dl6Ksi*4k3*a6$IJQ2pkas51x_A7g@KGo$;Q&jy*-6>-G zMGj+U*xrpicHF8# "/etc/wireguard/$wgif.conf" if "$deploy" ; then - systemctl enable "wg-quick@$wgif" - startwg.sh "$wgif" + run systemctl enable "wg-quick@$wgif" + run startwg.sh "$wgif" + [ "$?" -ne 0 ] && echo "Erreur wireguard" && returncode=1 else if [ -z "$(ip a | grep "$wgif")" ] ; then - wg-quick down "$wgif" + run wg-quick down "$wgif" fi fi fi @@ -138,9 +151,10 @@ fi section "Testing nginx conf" run nginx -t -c /etc/nginx/new_nginx.conf +[ "$?" -ne 0 ] && echo "Erreur nginx" && returncode=1 if [ "$noreload" == false ] ; then - restart_nginx.sh + run restart_nginx.sh fi section "Cleaning" @@ -151,4 +165,5 @@ if [ -z "$(ls -A "$HTTP_DIR")" ] ; then run rmdir "$HTTP_DIR" fi - +clean +exit "$returncode" diff --git a/provisioning/roles/deploy_all/files/bin/deploy_user.sh b/provisioning/roles/deploy_all/files/bin/deploy_user.sh new file mode 100755 index 0000000..1be510c --- /dev/null +++ b/provisioning/roles/deploy_all/files/bin/deploy_user.sh @@ -0,0 +1,26 @@ +#!/bin/bash + +set -euo pipefail + +if [ "$#" -ne 1 ] || [ -z "$1" ] ; then + echo "Usage: $0 " + exit 1 +fi + +service="$1" + +user_file="/docker/$service/deploy_user.sh" +env_file="/docker/$service/.env" + +if [ ! -f "$user_file" ] ; then + echo "No such file: $user_file" + exit 1 +fi + +if [ -f "$env_file" ] ; then + set -a + source "$env_file" + set +a +fi + +"$user_file" diff --git a/provisioning/roles/deploy_all/files/bin/deployall.sh b/provisioning/roles/deploy_all/files/bin/deployall.sh index b91b394..4a06b17 100755 --- a/provisioning/roles/deploy_all/files/bin/deployall.sh +++ b/provisioning/roles/deploy_all/files/bin/deployall.sh @@ -2,7 +2,7 @@ driglibash_run_retry=true . driglibash-base -set -euo pipefail +set -u # Already done at upload time ? #run gen_env.sh @@ -54,16 +54,15 @@ run mkdir -p "$new_nginx_conf_path" # Deploy services ############################################################################### -if [ -f "/data/unmounted" ] || [ ! -f "/data/mounted" ] ; then - die "Error: /data is not mounted." -fi - section "Start docker" run systemctl start docker docker.socket section "Deploy mandatory services" deploy_service.sh deployer.jean-cloud.org noreload +# List of failed services +failed="" + while read line ; do read -r service target <<<$(echo "$line") @@ -79,9 +78,17 @@ while read line ; do echo "Deploying" deploy_service.sh "$service" "noreload" + if [ "$?" -ne 0 ] ; then + failed="$failed $service" + fi -done < /docker/services.txt +done < <(grep -v '^[[:blank:]]*#' /docker/services.txt) restart_nginx.sh +if [ -n "$failed" ] ; then + echo "FAILED SERVICES" + echo "$failed" +fi + clean diff --git a/provisioning/roles/deploy_all/files/bin/findcert.sh b/provisioning/roles/deploy_all/files/bin/findcert.sh index beb5905..9d415f1 100755 --- a/provisioning/roles/deploy_all/files/bin/findcert.sh +++ b/provisioning/roles/deploy_all/files/bin/findcert.sh @@ -16,7 +16,7 @@ fi . /etc/jeancloud.env -# Look in both dns directories +# Look in both cert directories for dir in "$dns_certs_path" "$http_certs_path" ; do name="$(ls "$dir" | grep "^$service\(-[0-9]\{4\}\)\?$")" || true if [ -z "$name" ] ; then diff --git a/provisioning/roles/deploy_all/files/bin/gen_env.sh b/provisioning/roles/deploy_all/files/bin/gen_env.sh index f5b48f3..5e2f811 100755 --- a/provisioning/roles/deploy_all/files/bin/gen_env.sh +++ b/provisioning/roles/deploy_all/files/bin/gen_env.sh @@ -28,6 +28,7 @@ for dir in /docker/* ; do line_in_file "SECRET_DIR='/data/secrets/$service'" "/docker/$service/.env" line_in_file "DOCKER_DIR='/docker/$service'" "/docker/$service/.env" line_in_file "JC_SERVICE='$service'" "/docker/$service/.env" + line_in_file "HOME='/docker/$service'" "/docker/$service/.env" cert="$(findcert.sh "$service")" || true if [ -n "$cert" ] ; then line_in_file "JC_CERT='$cert'" "/docker/$service/.env" diff --git a/provisioning/roles/deploy_all/files/bin/init.sh b/provisioning/roles/deploy_all/files/bin/init.sh new file mode 100755 index 0000000..1678fe2 --- /dev/null +++ b/provisioning/roles/deploy_all/files/bin/init.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +while IFS=';' read -r uid username service server +do + home="/data/$service" + if [ -z "$(grep "^$username:" /etc/passwd)" ] ; then + useradd -m -U -r -d "$home" "$username" + fi + + # Do not touch the group, it can be set to something useful + chown "$username" "$home" + chmod 770 "$home" +done < <(grep -v '^#' /docker/services.csv) diff --git a/provisioning/roles/deploy_all/files/bin/rclone_ncloud_publiclink.sh b/provisioning/roles/deploy_all/files/bin/rclone_ncloud_publiclink.sh new file mode 100755 index 0000000..2991894 --- /dev/null +++ b/provisioning/roles/deploy_all/files/bin/rclone_ncloud_publiclink.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +. driglibash-base + +set -euo pipefail + +[ "$#" -ne 1 ] && die "Usage: $0 " +dest_dir="$1" +[ -z "$dest_dir" ] && die "Arg 'dest_directory' should not be empty." + + +# Get content from nextcloud +webdav_url="$(echo "$NC_SHARE_LINK" | sed 's#/s/.*#/public.php/webdav/#')" +webdav_user="$(echo "$NC_SHARE_LINK" |sed 's#.*/s/##')" +webdav_pass="$(rclone obscure "$NC_SHARE_PASSWORD")" + +rclone sync --config=/notfound --webdav-url="$webdav_url" --webdav-user="$webdav_user" --webdav-pass="$webdav_pass" --webdav-vendor=nextcloud :webdav: "$dest_dir" + +# Go to website +cd "$dest_dir" + +# Rename .attachement dirs created by nextcloud +while read filename ; do + oldname="$(basename "$filename")" + newname="${oldname:1}" + path="$(dirname "$filename")" + # And rename their references in md files + find -type f -iname '*.md' -exec sed -i "s/$oldname/$newname/g" {} \; + mv "$path/$oldname" "$path/$newname" +done < <(find -type d -name '.attachments.*') + diff --git a/services/services.txt b/services/services.txt index e6a9d69..9c068f9 100644 --- a/services/services.txt +++ b/services/services.txt @@ -1,39 +1,42 @@ +sftp.jean-cloud.net raku.jean-cloud.org benevoles31.karnaval.fr max.jean-cloud.org -feministesucl34.communisteslibertaires.org none +builder.rimarima.fr raku.jean-cloud.org chahut.jean-cloud.net max.jean-cloud.org +chiloe.eu shlago.jean-cloud.org +coldcms.chahut.jean-cloud.net raku.jean-cloud.org collectif-arthadie.fr vandamme.jean-cloud.org compagnienouvelle.fr nougaro.jean-cloud.org copaines.jean-cloud.net max.jean-cloud.org -cousinades.jean-cloud.net max.jean-cloud.org deployer.jean-cloud.org shlago.jean-cloud.org +dnscerts.jean-cloud.org max.jean-cloud.org etrevivant.net shlago.jean-cloud.org -feteducourt2020.jean-cloud.net shlago.jean-cloud.org +feministesucl34.communisteslibertaires.org none feteducourt.jean-cloud.net shlago.jean-cloud.org +feteducourt2020.jean-cloud.net shlago.jean-cloud.org git.jean-cloud.net vandamme.jean-cloud.org grapes.chahut.jean-cloud.net max.jean-cloud.org gypsylyonfestival.com max.jean-cloud.org inurbe.fr shlago.jean-cloud.org jean-cloud.net shlago.jean-cloud.org leida.fr vandamme.jean-cloud.org -dnscerts.jean-cloud.org max.jean-cloud.org lexicographe.jean-cloud.net shlago.jean-cloud.org metamorphosemagazine.fr shlago.jean-cloud.org +mux.radiodemo.oma-radio.fr raku.jean-cloud.org nc-backup.jean-cloud.net raku.jean-cloud.org -ns1.jean-cloud.org tetede.jean-cloud.org ns.jean-cloud.org shlago.jean-cloud.org +ns1.jean-cloud.org tetede.jean-cloud.org nuage.jean-cloud.net vandamme.jean-cloud.org +oma-radio.fr vandamme.jean-cloud.org pa1.studios.oma-radio.fr tetede.jean-cloud.org paj.oma-radio.fr nougaro.jean-cloud.org quadrille-elsa.jean-cloud.net shlago.jean-cloud.org -chiloe.eu shlago.jean-cloud.org -soundbase.radiodemo.oma-radio.fr montbonnot.jean-cloud.org radiodemo.oma-radio.fr raku.jean-cloud.org -mux.radiodemo.oma-radio.fr raku.jean-cloud.org radionimaitre.oma-radio.fr tetede.jean-cloud.org raplacgr.jean-cloud.net tetede.jean-cloud.org +rimarima.fr raku.jean-cloud.org rpnow.jean-cloud.net vandamme.jean-cloud.org -sftp.jean-cloud.net raku.jean-cloud.org +soundbase.radiodemo.oma-radio.fr montbonnot.jean-cloud.org +static.jean-cloud.net vandamme.jean-cloud.org velov.jean-cloud.net shlago.jean-cloud.org wiki-cgr.jean-cloud.net vandamme.jean-cloud.org -static.jean-cloud.net vandamme.jean-cloud.org -oma-radio.fr vandamme.jean-cloud.org +radio.karnaval.fr tetede.jean-cloud.org