deploytpl

#!/bin/bash
set -e

function usage {
	echo
	echo usage: $0 \<distribution\> \<guest name\> \<account\>
	echo
        exit 1
}

function bomb {
	echo FAIL $@
	exit 1
}

#fip=212.83.171.255
#reverse=france2.nethence.com
#node=2
#store=/data2
[[ ! -f /root/deploytpl.conf ]] && bomb missing
source /root/deploytpl.conf

[[ -z $fip ]] && bomb define fip= in deploytpl.conf
[[ -z $reverse ]] && bomb define reverse= in deploytpl.conf
[[ -z $node ]] && bomb define node= in deploytpl.conf
[[ -z $store ]] && bomb define store= in deploytpl.conf

#TODO switch to user db...
maxguests=5

#pubkey is optional
[[ -z $3 ]] && usage
distro=$1
name=$2
account=$3
guest=dnc-$account-$name
pubkey="$4"

# checks

[[ -f /etc/nginx/include/$name.conf ]] && bomb /etc/nginx/include/$name.conf already exists

#name=${guest#dnc-}

# /root/taken-ip-addresses.csv format as follows:
#
# 10.3.3.99,template,nobody
#
[[ ! -f /root/taken-ip-addresses.csv ]] && bomb need /root/taken-ip-addresses.csv:

echo -n how many guests does user $account has already?...
tmp=`grep -E ",$account$" /root/taken-ip-addresses.csv | wc -l`
echo $tmp
(( tmp > maxguests - 1 )) && echo you reached the maximum amount of guests allowed \($maxguests\) && exit 1

sub=10.3.3
last=`sort -V /root/taken-ip-addresses.csv | tail -1 | cut -f1 -d, | cut -f4 -d.`
(( last > 249 )) && bomb there is no ip4 left: $sub.$last is taken
(( suffix = last + 1 ))
ip=$sub.$suffix
echo -n provisioning ip4 address $ip ...
echo $ip,$name,$account >> /root/taken-ip-addresses.csv && echo done

gw=${ip%\.*}.$node

ip6=2001:bc8:204a:101::$suffix

   [[ $distro = focal ]] && vdisk=$distro.ext4		&& target=$guest.ext4
  [[ $distro = centos ]] && vdisk=$distro.xfs		&& target=$guest.xfs
  [[ $distro = buster ]] && vdisk=$distro.ext4		&& target=$guest.ext4

   [[ $distro = slack ]] && vdisk=$distro.reiser4	&& target=$guest.reiser4
  [[ $distro = netbsd ]] && vdisk=$distro.ffs		&& target=$guest.ffs
    [[ $distro = crux ]] && vdisk=$distro.reiser4	&& target=$guest.reiser4
[[ $distro = sabotage ]] && vdisk=$distro.reiser4	&& target=$guest.reiser4
[[ $distro = freebsdzfs ]] && vdisk=$distro.zfs		&& target=$guest.zfs

[[ ! -f /data/templates/$vdisk.tar ]] && bomb there is no such distro available: $vdisk.tar

#tpl=...
#tplname=${tpl%%\.*}

[[ -d $store/guests/$guest/ ]] && bomb guest with name $guest already exists
#$store/data/guests/$guest/ already exists

[[ -n `xl list | grep -E "^$guest[[:space:]]" | awk '{print $1}'` ]] && bomb guest with name $guest is already up and running

ping -c1 -W1 $ip >/dev/null 2>&1 && bomb $ip is already alive

#[[ ! -x /root/xen/deployguest.bash ]] \
#        && echo /root/xen/deployguest.bash not executable && exit 1
#[[ ! -x /root/xen/renameguest.bash ]] \
#        && echo /root/xen/renameguest.bash not executable && exit 1

#set -e helps here - as $store/guests/ should already exist
mkdir $store/guests/$guest/
mkdir $store/guests/$guest/lala/

# CWD is /root/ and we're going relative
cd $store/guests/$guest/

#/root/xen/deployguest.bash $tpl
#/root/xen/renameguest.bash $tplname $guest

#echo -n cloning sparse virtual disk...
#cp --sparse=always /data/templates/$vdisk $target && \
#	echo done || bomb

echo -n extracting sparse virtual disk from $vdisk.tar ...
tar xSf /data/templates/$vdisk.tar && echo done

echo -n renaming sparse virtual disk to $target ...
mv $vdisk $target && echo done

#echo -n checking $guest.reiser4...
#fsck.reiser4 -yf --fix --preen $guest.reiser4 >/dev/null 2>&1 && \
#	echo done || bomb
#echo -n mounting REISER4...
#
#mkdir lala/
#mount -o loop,rw $guest.reiser4 lala/ && 
#	echo done || bomb

echo -n mounting $target...
if [[ $distro = netbsd ]]; then
        mount -t ufs -o ufstype=44bsd $target lala/ && echo done || bomb
elif [[ $distro = freebsdzfs ]]; then
	# TODO deploy freebsdzfs guests concurrently
	# ...maybe by renaming pools?
	if [[ "`zpool list`" = "no pools available" ]]; then
		echo -n setting up the loop device...
		loopdevice=`losetup --find --partscan --show $target` && echo done || bomb

		echo -n getting to know about the pool...
		rmdir lala/
		mkdir lili/
		zpool import tank -R `pwd`/lili/ && echo done || bomb

		#WTF
		echo -n symlink fixup...
		ln -s lili/root/guests/freebsdzfs/lala && echo done || bomb
	else
		bomb concurrent freebsdzfs deployment - cannot proceed
	fi
else
	mount -o loop,rw $target lala/ && echo done || bomb

	# THO IT HAS BEEN ADDED INTO THE TEMPLATE ALREADY
	# BEWARE WE ARE ERASING EVERYTHING ONLY BECAUSE THIS IS OUR TEMPLATE ANYWAYS
	echo -n deploying modules...
	mkdir -p lala/lib/modules/
	rm -rf lala/lib/modules/*
	tar xzf /data/kernels/5.2.21.domureiser4.modules.tar.gz -C lala/lib/modules/ && echo done
fi
#for ball in `ls -1 /data/kernels/lib.modules.*.tar.gz`; do
#        echo -n $ball...
#        tar xzf $ball -C lala/lib/modules/ && echo done
#done; unset ball
echo

case $distro in
        focal)		source /root/xen/distro/ubuntu.bash	&& setup-ubuntu ;;
        buster)		source /root/xen/distro/debian.bash	&& setup-debian ;;
        centos)		source /root/xen/distro/centos.bash	&& setup-centos ;;
        slack)		source /root/xen/distro/slackware.bash	&& setup-slackware ;;
        netbsd)		source /root/xen/distro/netbsd.bash	&& setup-netbsd ;;
        crux)		source /root/xen/distro/crux.bash	&& setup-crux ;;
        sabotage)	source /root/xen/distro/sabotage.bash	&& setup-sabotage ;;
        freebsdzfs)	source /root/xen/distro/freebsd.bash	&& setup-freebsd ;;
        *)		bomb wrong distro: $distro ;;
esac

#echo -n DISABLING TEMPORARILY TMEM...
#rm -f lala/etc/modules && echo DONE

#echo -n ENABLING/OVERWRITING TMEM...
#echo tmem > lala/etc/modules && echo DONE

echo -n wipe-out host keys...
rm -f lala/etc/ssh/ssh_host_* && echo done || bomb

echo -n fresh ed25519...
ssh-keygen -q -t ed25519 -f lala/etc/ssh/ssh_host_ed25519_key -C "root@$name " -N "" && echo done || bomb

echo -n authorized keys...
#maybe w/o -p to make sure there's nothing from template?
mkdir -p lala/root/.ssh/
chmod 700 lala/root/.ssh/
cat > lala/root/.ssh/authorized_keys <<EOF && echo done || bomb
$pubkey

# DNC staff during test phases
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNWddNzcz/4w/B5fWTuMDO1jGyuWJhCn0j0WAD1/Pcf elge@extensa
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJTdirLiqtdrVX6nJAuRV0H4oqUV2RclQaIyq/McHEHy alex@alex
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDWBi3tOUvvRoKxxicZfAR5etbDpC56VSbiN+Z2bZ6Ph timur
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINck2Wn4DU8l0MZ//ASOdrh/jYdgv7CobLcm3265rZn8 timurdev
EOF
chmod 600 lala/root/.ssh/authorized_keys

# NETBSD SLACKWARE FREEBSD
if [[ -x lala/usr/libexec/sftp-server ]]; then
	sftp=/usr/libexec/sftp-server
	pam="UsePAM no"

# CENTOS
elif [[ -x lala/usr/libexec/openssh/sftp-server ]]; then
        sftp=/usr/lib/openssh/sftp-server
        pam="UsePAM no"

# UBUNTU
elif [[ -x lala/usr/lib/openssh/sftp-server ]]; then
	sftp=/usr/lib/openssh/sftp-server
	pam="UsePAM no"
# SABOTAGE
elif [[ -x lala/lib/ssh/sftp-server ]]; then
	sftp=/lib/ssh/sftp-server
	pam="#no pam support"
else
	bomb could not find sftp-server executable in $distro
fi

(( port = 2000 + suffix ))
[[ -z $port ]] && bomb could not define port
echo port is $port

[[ -n `grep ^wheel: lala/etc/group` ]] && wheel=wheel || wheel=root

echo -n tuning sshd for $port/tcp...
[[ ! -f lala/etc/ssh/sshd_config.dist ]] && mv lala/etc/ssh/sshd_config lala/etc/ssh/sshd_config.dist
[[ ! -f lala/etc/ssh/sshd_config.clean ]] && \
	grep -vE '^[[:space:]]*(#|$)' lala/etc/ssh/sshd_config.dist > lala/etc/ssh/sshd_config.clean
cat > lala/etc/ssh/sshd_config <<EOF && echo done || bomb
AllowGroups $wheel
AuthenticationMethods publickey
AuthorizedKeysFile .ssh/authorized_keys
ChallengeResponseAuthentication no
Ciphers aes128-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-gcm@openssh.com,aes256-ctr,chacha20-poly1305@openssh.com
HostKey /etc/ssh/ssh_host_ed25519_key
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-512
MaxAuthTries 1
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin without-password
Port $port
PrintMotd no
Protocol 2
StrictModes yes
UseDNS no
$pam
Subsystem sftp $sftp
X11Forwarding no
EOF
# WE NEED port VARIABLE THEREAFTER!
unset sftp wheel
# SILENT HOT FIX
rm -f lala/root/sshd_config

if [[ $distro = freebsdzfs ]]; then
	echo -n forgetting that pool...
	zpool export tank && echo done || bomb
	rm -f lala
	rm -rf lili/
	#rmdir lili

	echo -n getting rid of the loop device...
	losetup -d $loopdevice && echo done || bomb
	unset loopdevice
else
	echo -n umount...
	umount lala/ && echo done || bomb
	rmdir lala/
fi

# vif has 13 chars max just like that dhclient bug
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=704072
# so we cannot use full-blown guest name there

# NETBSD
if [[ $distro = netbsd ]]; then
	echo -n netbsd guest configuration...
	cat > $guest <<EOF && echo done
#kernel = "/data/kernels/netbsd-current/netbsd-INSTALL.gz"
kernel = "/data/kernels/netbsd-current/netbsd-GENERIC.gz"
#kernel = "/data/kernels/netbsd-current/netbsd-GENERIC_KASLR.gz"
root = "xbd0a"
#extra = "-v -s"
name = "$guest"
memory = 1024
vcpus = 3
maxvcpus = 8
disk = ['tap:tapdisk:aio:$store/guests/$guest/$guest.ffs,xvda,w']
vif = [ 'bridge=br0,vifname=v$suffix.0',
        'bridge=br0,vifname=v$suffix.1']
type = "pvh"
EOF

# FREEBSD - specific ZFS built-in kernel here
elif [[ $distro = freebsdzfs ]]; then
        echo -n freebsdzfs guest configuration...
        cat > $guest <<EOF && echo done
kernel = "/data/kernels/kernel-zfs"
extra = "vfs.root.mountfrom=zfs:tank/root"
memory = 7168
name = "$guest"
vcpus = 3
maxvcpus = 8
disk = ['tap:tapdisk:aio:$store/guests/$guest/$guest.zfs,xvda,w']
vif = [ 'bridge=br0, vifname=$suffix.0',
	'bridge=br0, vifname=$suffix.1' ]
type = "pvh"
EOF

# LINUCES
else
	echo -n linux guest configuration...
	cat > $guest <<EOF && echo done
kernel = "/data/kernels/5.2.21.domureiser4.vmlinuz"
root = "/dev/xvda1 ro console=hvc0 net.ifnames=0 biosdevname=0 mitigations=off"
name = "$guest"
vcpus = 3
maxvcpus = 8
memory = 7168
disk = ['tap:tapdisk:aio:$store/guests/$guest/$target,xvda1,w']
vif = [ 'bridge=br0, vifname=v$suffix' ]
type = "pvh"
EOF
fi

#this requires the basic ruleset to be there
#
#flush ruleset
#
#table ip nat {
#        chain postrouting {
#                type nat hook postrouting priority 100;
#                ip saddr 10.3.3.0/24 oif xenbr0 snat 212.83.171.255
#        }
#        chain prerouting {
#                type nat hook prerouting priority -100;
#        }
#}
echo -n adding port-forwarding rule...
/usr/sbin/nft add rule nat prerouting iif xenbr0 ip daddr $fip tcp dport $port dnat $ip && echo done || bomb

echo -n updating nftables.conf...
mkdir -p /etc/backup/
mv -f /etc/nftables.conf /etc/backup/nftables.conf.`date +%s`
cat > /etc/nftables.conf <<EOF
flush ruleset

EOF
/usr/sbin/nft list ruleset >> /etc/nftables.conf && echo done || bomb

# careful with escapes here
echo -n adding nginx vhost...
cat > /etc/nginx/conf.d/$name.conf <<EOF && echo done || bomb
server {
        listen 80;
        listen [::]:80;
        server_name $name.nethence.com;

        # HTTP redirect to HTTPS
        location / {
                return 301 https://\$host\$request_uri;
        }

        # deal with http-01 challenges (no http2 there)
        location ^~ /.well-known/acme-challenge/ {
                default_type "text/plain";
                # the trailing slash matters
                alias /var/www/dehydrated/;
        }
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name $name.nethence.com;
        #without includeSubDomains
        add_header Strict-Transport-Security "max-age=31536000" always;
        ssl_certificate     /etc/dehydrated/certs/nethence_com/fullchain.pem;
        ssl_certificate_key /etc/dehydrated/certs/nethence_com/privkey.pem;

        location / {
		proxy_pass http://$ip/;
        }

        autoindex on;
        autoindex_exact_size off;
        location = /robots.txt          { access_log off; log_not_found off; }
        location = /favicon.ico         { access_log off; log_not_found off; }
        location ~ /apple-touch-icon    { access_log off; log_not_found off; }
        #location ~ /\.                 { access_log off; log_not_found off; deny all; }
        #location ~ ~\$                  { access_log off; log_not_found off; deny all; }
}
EOF

# DNS wildcard points to IP4 round-robin pool
echo -n reloading nginx...
/usr/local/sbin/nginx -s reload && echo done || bomb

#absolute path in process list is a nice thing to have
#self-verbose
echo -n starting guest...
xl create $store/guests/$guest/$guest >> /root/deploytpl.log 2>&1 && echo done || bomb

cat <<EOF

 You guest $name is booting.  You can reach it through SSH on IPv6 (possibly through a 4to6 tunnel)

	ping6 $ip6
	ssh $ip6 -l root -p $port

 or IPv4 and through port-forwarding

	nmap -p $port $reverse
        ssh $reverse -l root -p $port

EOF

#STATUS:BOOTING
#HOSTNAME:$name
#(DATASTORE:$store)
#(XEN GUEST NAME:$guest)
#IP:$ip
#GW:$gw
#IP6: coming soon
#FAILOVERIP:$fip
#REVERSE:$reverse
#PORT-FWD:$port