deploy

#!/bin/bash

##
## i-doit virtual appliance
## Deploy i-doit on OS
##

##
## Copyright (C) 2018-20 synetics GmbH, <https://i-doit.com/>
##
## This program is free software: you can redistribute it and/or modify
## it under the terms of the GNU Affero General Public License as published by
## the Free Software Foundation, either version 3 of the License, or
## (at your option) any later version.
##
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
## GNU Affero General Public License for more details.
##
## You should have received a copy of the GNU Affero General Public License
## along with this program. If not, see <http://www.gnu.org/licenses/>.
##

set -euo pipefail
IFS=$'\n\t'

##
## Configuration
##

: "${IVA_USER:="idoit"}"
: "${IVA_HOSTNAME:="idoitappliance"}"
: "${MAX_NUMBER_OF_OPEN_FILES:="65535"}"

##------------------------------------------------------------------------------

function execute {
    log "Prepare operating system"

    export DEBIAN_FRONTEND="noninteractive"

    changeHostname
    # TODO Installing VirtualBox Guest addtions causes a broken network
    # connection:
    #installGuestAdditions
    configureAPT
    configureDpkg
    installDebianPackages
    removeDebianPackages
    installIdoit
    installFiles
    updateApacheConfig
    prepareSudo
    prepareUser "$IVA_USER" "/home/${IVA_USER}"
    autostartMenu
    grantAccess
    prepareUser "root" "/root"
    ## TODO phive's key handling is too fragile… Expect timeouts:
    #installIdoitCLI
    enableFirewall
    configureSecurityLimits
    ## Configure etckeeper after most configuration steps are done:
    configureEtckeeper
    zeroDisk
    cleanUp

    #   vhost /appliance with basic auth and:
    #       phpinfo.php
    #       backups

    #   add tls vhost, but leave it disabled
    #   HTTP/2.0 with self-signed cert
}

function changeHostname {
    log "Change hostname to $IVA_HOSTNAME"

    echo "$IVA_HOSTNAME" > /etc/hostname || \
        abort "Unable to edit /etc/hostname"

    {
        echo -e "127.0.0.1\\t$IVA_HOSTNAME"
        echo -e "::1\\t\\t$IVA_HOSTNAME"
    } >> /etc/hosts || \
        abort "Unable to edit /etc/hosts"
}

function installGuestAdditions {
    local iso="/home/${IVA_USER}/VBoxGuestAdditions.iso"

    test -f "$iso" || return

    log "Install VirtualBox guest additions from ISO file"

    mount -t iso9660 -o loop "$iso" /mnt 2> /dev/null || \
        abort "Unable to mount ISO file"
    /mnt/VBoxLinuxAdditions.run || \
        abort "Unable to install guest additions"
    umount /mnt || \
        abort "Unable to unmount ISO file"
    rm "$iso" || \
        abort "Unable to remove ISO file"
}

function configureAPT {
    local confFile="/etc/apt/apt.conf.d/99_norecommends"

    log "Configure APT"

    cat << EOF > "$confFile" || \
        abort "Unable to edit file $confFile"
APT::Install-Recommends "false";
APT::AutoRemove::RecommendsImportant "false";
APT::AutoRemove::SuggestsImportant "false";
Dir::Cache {
    srcpkgcache "";
    pkgcache "";
}
EOF
}

function configureDpkg {
    log "Configure dkpg"
    cat << EOF > /etc/dpkg/dpkg.cfg.d/01_i-doit || \
        abort "Unable to edit file"
path-exclude /usr/share/doc/*
# we need to keep copyright files for legal reasons
path-include /usr/share/doc/*/copyright
path-exclude /usr/share/man/*
path-exclude /usr/share/groff/*
path-exclude /usr/share/info/*
# lintian stuff is small, but really unnecessary
path-exclude /usr/share/lintian/*
path-exclude /usr/share/linda/*
# translations
path-exclude /usr/share/locale/*
path-include /usr/share/locale/en*
path-include /usr/share/locale/de*
path-include /usr/share/locale/es*
path-include /usr/share/locale/ja*
path-include /usr/share/locale/fr*
path-include /usr/share/locale/zh*
EOF
}

function installDebianPackages {
    log "Keep your Debian packages up-to-date"

    apt-get -qq --yes update || \
        abort "Unable to update Debian package repositories"
    apt-get -qq --yes full-upgrade || \
        abort "Unable to perform update of Debian packages"
    apt-get -qq --yes clean || \
        abort "Unable to cleanup Debian packages"
    apt-get -qq --yes autoremove || \
        abort "Unable to remove unnecessary Debian packages"

    log "Install required Debian packages"

    apt-get -qq --yes install \
        apt-listchanges \
        atop \
        build-essential \
        dialog \
        dirmngr \
        distro-info-data \
        etckeeper \
        git \
        graphviz \
        htop \
        lsb-release \
        moreutils \
        mycli \
        nano \
        ntp \
        nullmailer \
        procinfo \
        procps \
        pwgen \
        rsync \
        sudo \
        tmux \
        tree \
        ufw \
        unattended-upgrades \
        unzip \
        vim \
        zsh || \
        abort "Unable to install required Debian packages"

    apt-get -qq --yes install \
        auditd || \
        abort "Unable to install required Debian packages"
}

function removeDebianPackages {
    log "Remove Debian packages which are not needed"

    apt-get -qq --yes remove --purge \
        bluetooth bluez crda eject iw laptop-detect mutt powertop telnet \
        wireless-regdb wireless-tools wpasupplicant || \
        abort "Unable to remove Debian packages"

    apt-get -qq --yes autoremove || \
        abort "Unable to remove unnecessary Debian packages"
}

function installFiles {
    local srcDir="/tmp"

    log "Install files"

    install -m 775 "$srcDir"/appliance-* /usr/local/bin/ || \
        abort "Unable to install scripts"
    chown root:root -R /usr/local/bin || \
        abort "Unable to change owner"

    install -m 664 "$srcDir"/bash_aliases /root/.bash_aliases || \
        abort "Unable to install file"
    install -m 664 "$srcDir"/bashrc /root/.bashrc || \
        abort "Unable to install file"
    chown root:root -R /root/ || \
        abort "Unable to change owner"

    install -m 664 "$srcDir"/bash_aliases /home/"$IVA_USER"/.bash_aliases || \
        abort "Unable to install file"
    install -m 664 "$srcDir"/bashrc /home/"$IVA_USER"/.bashrc || \
        abort "Unable to install file"
    chown "$IVA_USER":"$IVA_USER" -R /home/"$IVA_USER"/ || \
        abort "Unable to change owner"

    install -m 644 "$srcDir"/apache2/sites-available/*.conf \
        /etc/apache2/sites-available/ || \
        abort "Unable to install files"

    install -m 775 "$srcDir"/network/if-up.d/* /etc/network/if-up.d/ || \
        abort "Unable to install script"

    install -m 664 "$srcDir"/appliance_version /etc/ || \
        abort "Unable to install file"
    chown root:root /etc/appliance_version || \
        abort "Unable to change owner"
    install -m 664 "$srcDir"/issue-standard /etc/issue || \
        abort "Unable to install file"
    install -m 664 "$srcDir"/issue-standard /etc/issue-net || \
        abort "Unable to install file"
    install -m 664 "$srcDir"/issue-standard /etc/ || \
        abort "Unable to install file"
    chown root:root /etc/issue* || \
        abort "Unable to change owner"
}

function installIdoit {
    log "Install i-doit"

    git clone --quiet \
        https://github.com/bheisig/i-doit-scripts.git \
        /tmp/i-doit-scripts || \
        abort "Unable to clone repository"
    cd /tmp/i-doit-scripts/ || \
        abort "Unable to change directory"
    make install || \
        abort "Unable to install i-doit scripts"

    yes "" | idoit-install

    ## TODO Problem with failed pipe (exit code 141):
    if [[ "$?" -ge 1 && "$?" -le 128 ]]; then
        abort "Unable to install i-doit"
    fi
}

function updateApacheConfig {
    local htaccessFile="/var/www/html/.htaccess"
    local apacheConfigFile="/etc/apache2/sites-available/i-doit-secure.conf"
    local apacheSubstitution="## Insert content from .htaccess file"

    log "Update Apache's VHost config from i-doit's htaccess file"

    sed -i \
        -e "/${apacheSubstitution}/ {" \
        -e "r ${htaccessFile}" \
        -e "d" \
        -e "}" \
        "$apacheConfigFile" || \
        abort "Unable to change config file"

    unitctl "restart" "apache2"
}

function installIdoitCLI {
    log "Install phive"

    wget --quiet -O phive.phar https://phar.io/releases/phive.phar || \
        abort "Unable to download phive"
    wget --quiet -O phive.phar.asc https://phar.io/releases/phive.phar.asc || \
        abort "Unable to download signature"
    gpg \
        --keyserver hkps.pool.sks-keyservers.net \
        --recv-keys 0x9D8A98B29B2D5D79 || \
        abort "Unable to download public key"
    gpg --verify phive.phar.asc phive.phar || \
        abort "Unable to verify phive"
    chmod +x phive.phar || \
        abort "Unable to modify file"
    mv phive.phar /usr/bin/phive || \
        abort "Unable to move file"

    log "Install idoitcli"

    yes "y" | phive install --global bheisig/i-doit-cli

    ## TODO Problem with failed pipe (exit code 141):
    if [[ "$?" -ge 1 && "$?" -le 128 ]]; then
        abort "Unable to install via phive"
    fi
}

function prepareUser {
    local user="$1"
    local group="$user"
    local home="$2"

    log "Prepare user $user"

    mkdir -m 700 "${home}/.ssh" || \
        abort "Unable to create directory"
    touch "${home}/.ssh/config" || \
        abort "Unable to touch file"
    chmod 600 "${home}/.ssh/config" || \
        abort "Unable to change modifier"
    touch "${home}/.ssh/authorized_keys" || \
        abort "Unable to touch file"
    chmod 600 "${home}/.ssh/authorized_keys" || \
        abort "Unable to change modifier"
    chown "${user}":"${group}" -R "${home}/.ssh" || \
        abort "Unable to change ownership"
}

function prepareSudo {
    local file="/etc/sudoers.d/i-doit"

    cat << EOF > "$file" || \
        abort "Unable to edit file ${file}"
Defaults        env_keep += "http_proxy https_proxy"
%sudo ALL=(ALL) NOPASSWD: ALL
EOF
}

function grantAccess {
    log "Grant user access to logs"
    usermod -aG systemd-journal "$IVA_USER" || \
        abort "Unable to add user $IVA_USER to group systemd-journal"
}

function autostartMenu {
    echo "test -x \"\$(command -v appliance-menu)\" && sudo appliance-menu" \
        >> "/home/${IVA_USER}"/.bashrc || \
        abort "Unable to add appliance menu to /home/${IVA_USER}/.bashrc"
}

function enableFirewall {
    log "Enable host-based firewall ufw (frontend for iptables)"

    ufw enable || \
        abort "Unable to configure firewall"
    ufw default deny incoming || \
        abort "Unable to configure firewall"
    ufw default allow outgoing || \
        abort "Unable to configure firewall"
    ufw allow ssh || \
        abort "Unable to configure firewall"
    ufw allow 80/tcp || \
        abort "Unable to configure firewall"
    ufw allow 443/tcp || \
        abort "Unable to configure firewall"
}

function configureSecurityLimits {
    local confFile="/etc/security/limits.d/i-doit.conf"

    log "Configure security limits"

    log "Set max number of open files to $MAX_NUMBER_OF_OPEN_FILES"

    echo \
        -e "*\tsoft\tnofile\t$MAX_NUMBER_OF_OPEN_FILES" \
        >> "$confFile" || \
        abort "Unable to edit file $confFile"
    echo \
        -e "*\thard\tnofile\t$MAX_NUMBER_OF_OPEN_FILES" \
        >> "$confFile" || \
        abort "Unable to edit file $confFile"
}

function configureEtckeeper {
    log "Configure etckeeper"

    cd /etc/ || abort "/etc/ not found"
    git gc || abort "Unable to pack git repository"
}

function zeroDisk {
    log "Zero disk"

    cat /dev/zero > zero.fill 2> /dev/null
    sync
    sleep 1
    sync
    rm -f zero.fill
    sync
    sleep 5
}

function cleanUp {
    log "Clean up"

    log "Remove unnecessary Apache configuration files"
    rm \
        /etc/apache2/sites-available/000-default.conf \
        /etc/apache2/sites-available/default-ssl.conf || \
        abort "Unable to remove files"

    log "Remove documentation"
    find /usr/share/doc -depth -type f ! -name copyright -print0 | xargs rm || \
        abort "Unable to remove files"
    find /usr/share/doc -empty -print0 |xargs rmdir || \
        abort "Unable to remove directories"
    rm -rf \
        /usr/share/groff/* \
        /usr/share/info/* \
        /usr/share/lintian/* \
        /usr/share/linda/* \
        /var/cache/man/* \
        /usr/share/man/* || \
        abort "Unable to remove files"

    log "Remove translations"
    find /usr/share/locale -mindepth 1 -maxdepth 1 \
        ! -name 'en' \
        ! -name 'de*' \
        ! -name 'es*' \
        ! -name 'ja*' \
        ! -name 'fr*' \
        ! -name 'zh*' \
        -print0 \
        | xargs rm -r || \
        abort "Unable to remove files"

    appliance-cleanup || \
        abort "Unable to clean up"
}

function unitctl {
    local action="$1"
    local unit="$2"

    log "${action^} $unit"

    systemctl -q "$action" "${unit}.service" || \
        abort "Failed to $action $unit"
}

function setup {
    test "$(whoami)" = "root" || \
        abort "Only user 'root' may execute this script"
}

function log {
    echo -e "$1"
}

function finish {
    log "Done. Have fun :-)"
    exit 0
}

function abort {
    log "$1"
    log "Operation failed. Please check what is wrong and try again."
    exit 1
}

##------------------------------------------------------------------------------

if [[ "${BASH_SOURCE[0]}" = "$0" ]]; then
    setup && execute && finish
fi