update_jdn.sh 25.2 KB
Newer Older
1
#!/bin/bash
2
# Copyright 2012-2017 Holger Levsen <holger@layer-acht.org>
3
4
# released under the GPLv=2

5
6
set -e

7
BASEDIR="$(dirname "$(readlink -e $0)")"
8
9
PVNAME=/dev/vdb      # LVM physical volume for jobs
VGNAME=jenkins01     # LVM volume group
10
STAMP=/var/log/jenkins/update-jenkins.stamp
11
TMPFILE=$(mktemp)
12
13
14
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
JJB="jenkins-job-builder $@"
15
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
16

17
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
18
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
19
	UP2DATE=true
Philip Hands's avatar
Philip Hands committed
20
21
else
	UP2DATE=false
22
23
24
fi


Holger Levsen's avatar
Holger Levsen committed
25
explain() {
Holger Levsen's avatar
Holger Levsen committed
26
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
27
28
}

29
30
31
32
33
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
		sudo ntpdate -b de.pool.ntp.org
}
34

35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
disable_dsa_check_packages() {
	# disable check for outdated packages as in the future (like this)
	# packages from security.d.o will appear outdated always…
	echo -e "#!/bin/sh\n# disabled dsa-check by update_jdn.sh\nexit 0" > /usr/local/bin/dsa-check-packages
	chmod a+rx /usr/local/bin/dsa-check-packages

	# FIXME: remove the repair of /bin/true when all hosts has been
	# updated
	# ln -s /bin/true /usr/local/bin/dsa-check-packages was used which
	# broke /bin/true by overwriting it with the perl script dsa-check-packages
	if grep -q '/usr/bin/perl' /bin/true ; then
		apt-get install --reinstall coreutils
	fi
}

50
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
51
explain "$(date) - begin deployment update."
52

53
# some nodes need special treatment…
54
case $HOSTNAME in
55
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
56
		# set correct date
57
		set_correct_date
58
		;;
59
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
60
		# set correct date
61
		set_correct_date
Holger Levsen's avatar
Holger Levsen committed
62
		;;
63
64
65
	*)	;;
esac

66
67
68
#
# set up users and groups
#
69
if ! getent passwd jenkins > /dev/null ; then
70
	sudo addgroup --system jenkins
71
	sudo adduser --system --shell /bin/bash --home /var/lib/jenkins --ingroup jenkins --disabled-login jenkins
72
fi
Holger Levsen's avatar
Holger Levsen committed
73
if ! getent group jenkins-adm > /dev/null ; then
74
75
	sudo addgroup --system jenkins-adm
fi
76
if ! getent passwd jenkins-adm > /dev/null  ; then
Holger Levsen's avatar
Holger Levsen committed
77
	sudo adduser --system --shell /bin/bash --home /home/jenkins-adm --ingroup jenkins-adm --disabled-login jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
78
	sudo usermod -G jenkins jenkins-adm
79
fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
80
if [ ! -d /home/jenkins-adm ]; then
Mattia Rizzolo's avatar
Mattia Rizzolo committed
81
82
83
    sudo mkdir /home/jenkins-adm
    sudo chown jenkins-adm.jenkins-adm /home/jenkins-adm
fi
84

85
86

declare -A user_host_groups u_shell
87
88

sudo_groups='jenkins,jenkins-adm,sudo,adm'
89
90
91
92
93
94
95
96
97

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
# and add checks for the GROUP version whereever the HOSTNAME is checked in the following code

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
98
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
99
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
Philip Hands's avatar
Philip Hands committed
100
user_host_groups['phil','profitbricks-build10-amd64']="$sudo_groups"
101
user_host_groups['phil','jenkins']="$sudo_groups"
102
user_host_groups['lunar','jenkins']='reproducible'
103
104
user_host_groups['lynxis','profitbricks-build3-amd64']="$sudo_groups"
user_host_groups['lynxis','profitbricks-build4-amd64']="$sudo_groups"
105
user_host_groups['hans','profitbricks-build7-amd64']="$sudo_groups"
106
107
user_host_groups['vagrant','armhf']="$sudo_groups"
user_host_groups['vagrant','arm64']="$sudo_groups"
108

109
110

u_shell['mattia']='/bin/zsh'
111
u_shell['lynxis']='/bin/fish'
112
u_shell['jenkins-adm']='/bin/bash'
113

114
115
116
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

117
( $UP2DATE && [ -z $(find authorized_keys -newer $0) ] ) || for user in ${users}; do
118
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
119
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
120
121
		continue
	fi
122

123
124
125
126
127
128
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
129
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
130
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
131
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
132
			break
133
		fi
134
135
136
137
138
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
139
	fi
140
141
done

142
# change defaults
143
144
145
$UP2DATE || grep -q '^AuthorizedKeysFile' /etc/ssh/sshd_config || {
	sudo sh -c "echo 'AuthorizedKeysFile /var/lib/misc/userkeys/%u %h/.ssh/authorized_keys' >> /etc/ssh/sshd_config"
	sudo service ssh reload
146
}
147
148
149
150
151
# change vagrants manual configuration on some armhf hosts
$UP2DATE || grep -q '/var/lib/misc/userkeys' /etc/ssh/sshd_config || {
	sudo sed -i "s#/var/lib/monkeysphere/authorized_keys/#/var/lib/misc/userkeys/#g" /etc/ssh/sshd_config
	sudo service ssh reload
}
152

153
154
155
156
157
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

158
if [ "$HOSTNAME" = "jenkins-test-vm" ] || [ "$HOSTNAME" = "profitbricks-build10-amd64" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
159
	# jenkins needs access to libvirt
160
	sudo adduser jenkins kvm
161
162
163
	sudo adduser jenkins libvirt
	sudo adduser jenkins libvirt-qemu

164
	# we need a directory for the VM's storage pools
165
	VM_POOL_DIR=/srv/lvc/vm-pools
166
	if [ ! -d $VM_POOL_DIR ] ; then
167
		sudo mkdir -p $VM_POOL_DIR
168
169
170
		sudo chown jenkins:libvirt-qemu $VM_POOL_DIR
		sudo chmod 775 $VM_POOL_DIR
	fi
171
172
173
174
175
176

	# tidy up after ourselves, for a while at least
	OLD_VM_POOL_DIR=/srv/workspace/vm-pools
	if [ -d "$OLD_VM_POOL_DIR" ] ; then
		sudo rm -r "$OLD_VM_POOL_DIR"
	fi
177
fi
178

179
180
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
181
182
183
184
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
Holger Levsen's avatar
Holger Levsen committed
185
	profitbricks-build9-amd64)
186
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
187
188
		TMPSIZE=8
		;;
Holger Levsen's avatar
Holger Levsen committed
189
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
190
191
192
		TMPFSSIZE=200
		TMPSIZE=15
		;;
193
194
195
196
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
197
198
199
	*) ;;
esac
case $HOSTNAME in
200
201
202
203
204
205
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
206
	jenkins|profitbricks-build*amd64|codethink*)
207
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
208
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
209
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
210
211
212
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
213
214
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
215
				sudo mount /srv/workspace
216
			else
217
				explain "WARNING: mountpoint /srv/workspace is non-empty."
218
219
220
221
222
			fi
		fi
		;;
	*) ;;
esac
223
case $HOSTNAME in
224
	profitbricks-build10-amd64)
225
226
227
228
229
230
231
232
233
234
235
236
237
238
		[ -d /srv/lvc/vm-pools ] || sudo mkdir -p /srv/lvc/vm-pools
		if ! grep -q '^/dev/vdb\s\+/srv/lvc/vm-pools\s' /etc/fstab; then
			echo "/dev/vdb	/srv/lvc/vm-pools ext4	errors=remount-ro	0	2" | sudo tee -a /etc/fstab >/dev/null  
		fi
		if ! mountpoint -q /srv/lvc/vm-pools; then
			if test -z "$(ls -A /srv/lvc/vm-pools)"; then
				sudo mount /srv/lvc/vm-pools
			else
				explain "WARNING: mountpoint /srv/lvc/vm-pools is non-empty."
			fi
		fi
		;;
	*) ;;
esac
239

240
# make sure needed directories exists - some directories will not be needed on all hosts...
241
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /srv/live-build /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
242
243
244
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
Holger Levsen's avatar
Holger Levsen committed
245
	sudo chown jenkins.jenkins $directory
246
done
Holger Levsen's avatar
Holger Levsen committed
247
for directory in /srv/jenkins ; do
248
249
250
251
252
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
253

254
if ! test -h /chroots; then
Holger Levsen's avatar
Holger Levsen committed
255
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
256
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
257
		explain "/chroots could not be cleared."
258
	else
259
		sudo ln -s /srv/workspace/chroots /chroots
260
261
262
	fi
fi

263
264
265
266
267
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
268
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
Holger Levsen's avatar
Holger Levsen committed
269
270
		DEBS=" 
			bash-completion 
271
272
			bc
			bsd-mailx
273
274
			curl
			debian-archive-keyring
275
			debootstrap 
276
277
			devscripts
			eatmydata
278
			etckeeper
279
			figlet
Holger Levsen's avatar
Holger Levsen committed
280
			git
281
			haveged
Holger Levsen's avatar
Holger Levsen committed
282
			htop
283
			less
284
			lintian
285
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
286
			lsof
287
288
			molly-guard
			moreutils
289
			munin-node
290
291
			munin-plugins-extra
			netcat-traditional
292
293
			ntp
			ntpdate
294
			pigz 
295
			postfix
296
			procmail
297
			psmisc
298
			python3-psycopg2 
Holger Levsen's avatar
Holger Levsen committed
299
			schroot 
300
301
			screen
			slay
302
			stunnel
Holger Levsen's avatar
Holger Levsen committed
303
304
305
306
307
			subversion 
			subversion-tools 
			sudo 
			unzip 
			vim 
308
			zsh
309
			"
310
		# install squid everywhere except on the armhf nodes
311
		case $HOSTNAME in
312
			jenkins|jenkins-test-vm|profitbricks-build*|codethink*) DEBS="$DEBS
313
				squid3
314
315
				kgb-client
				python3-yaml" ;;
316
317
			*) ;;
		esac
318
319
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
320
			profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
321
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
322
323
			*) ;;
		esac
324
		# needed to run coreboot/openwrt/lede/netbsd/fedora jobs
325
		case $HOSTNAME in
326
			profitbricks-build3-amd64|profitbricks-build4-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
327
				bison
328
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
329
330
331
				cmake
				diffutils
				findutils
332
				fish
Holger Levsen's avatar
Holger Levsen committed
333
334
335
336
337
338
339
340
341
342
343
344
345
346
				flex
				g++
				gawk
				gcc
				git
				grep
				iasl
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
347
348
				python3-clint
				python3-git
349
				python3-pystache
350
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
351
352
				python3-yaml
				subversion
353
				sysvinit-core
354
				tree
Holger Levsen's avatar
Holger Levsen committed
355
356
357
				unzip
				util-linux
				zlib1g-dev"
358
359
360
			;;
			*) ;;
		esac
361
362
363
		# needed to run fdroid jobs
		case $HOSTNAME in
			profitbricks-build7-amd64) DEBS="$DEBS
364
				android-sdk
365
				fdroidserver
366
				libvirt-clients
367
368
				libvirt-daemon
				libvirt-daemon-system
369
				python3-libvirt
370
				python3-vagrant
371
				qemu-kvm
372
373
374
				vagrant
				vagrant-mutate
				vagrant-libvirt"
375
			;;
376
377
			*) ;;
		esac
378
		# cucumber dependencies (for lvc jobs)
379
380
381
382
383
		case $HOSTNAME in
			profitbricks-build10-amd64|jenkins-test-vm) DEBS="$DEBS
				cucumber
				tesseract-ocr
				i18nspector
Holger Levsen's avatar
Holger Levsen committed
384
				imagemagick
385
386
				libav-tools
				libsikuli-script-java
387
				libvirt-bin
388
389
390
391
				libvirt-dev
				ovmf
				python-jabberbot
				python-potr
392
				python3-yaml
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
				ruby-guestfs
				ruby-libvirt
				ruby-net-irc
				ruby-packetfu
				ruby-rb-inotify
				ruby-rjb
				ruby-test-unit
				tcpdump
				unclutter
				virt-viewer
				x264
				xvfb
				x11vnc"
			   ;;
			*) ;;
		esac
409
410
411
412
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
		fi
413
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
414
415
416
417
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
418
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
419
420
421
422
423
424
425
426
427
428
				binfmt-support 
				bison 
				build-essential 
				calamaris 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
429
				flex
Holger Levsen's avatar
Holger Levsen committed
430
				gawk 
431
432
				ghc
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
433
434
435
436
				gocr 
				graphviz 
				iasl 
				imagemagick 
437
438
				ip2host
				jekyll
439
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
440
441
442
443
444
445
446
447
448
449
				libapache2-mod-macro 
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libvirt0 
				libvirt-bin 
				libvpx1 
				libxslt1-dev 
450
				linux-image-amd64
Holger Levsen's avatar
Holger Levsen committed
451
452
453
454
455
456
457
458
				moreutils 
				mr 
				mtr-tiny 
				munin 
				ntp 
				openbios-ppc 
				openbios-sparc 
				openjdk-7-jre 
459
				pandoc
460
				postgresql
461
				postgresql-autodoc
Holger Levsen's avatar
Holger Levsen committed
462
463
464
465
				postgresql-client-9.4 
				poxml 
				procmail 
				python3-debian 
466
				python3-pystache
467
468
469
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
				python-arpy 
				python-hachoir-metadata 
				python-imaging 
				python-lzma 
				python-pip 
				python-rpy2 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
				ruby-json 
				ruby-rspec 
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
				syslinux 
491
				tor
Holger Levsen's avatar
Holger Levsen committed
492
				vncsnapshot 
493
494
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
495
				x11-apps 
496
				xtightvncviewer
497
				xvfb
498
				xvkbd
499
				zutils"
500
501
502
		else
			MASTERDEBS=""
		fi
503
		$UP2DATE || ( sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/etc/apt/sources.list /etc/apt ; sudo apt-get update )
504
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
505
		# dont (re-)install pbuilder if it's on hold
506
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
507
508
509
510
511
512
513
514
			case $HOSTNAME in
				codethink*) 	$UP2DATE || sudo apt-get install -t jessie-backports pbuilder
						;;
				*)		$UP2DATE || sudo apt-get install -t jessie-backports \
							pbuilder lintian || echo "this should only fail on the first install"
				;;
			esac
		fi
515
		# remove unattended-upgrades if it's installed
516
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
517
			 sudo apt-get -y purge unattended-upgrades
518
		fi
519
		# we need mock from bpo to build current fedora
520
521
		if [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
			$UP2DATE || sudo apt-get install -t jessie-backports mock \
522
				|| echo "this should only fail on the first install"
523
		fi
524
525
526
527
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default i386 kernel on pb-build2+12-i386)
		# - we use the default amd64 kernel on pb-build1+11 (and the default amd64 kernel on pb-build6+16-i386)
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] ; then
528
			$UP2DATE || sudo apt-get install -t jessie-backports linux-image-amd64 || echo "this should only fail on the first install"
529
530
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] ; then
			$UP2DATE || sudo apt-get install linux-image-amd64
531
		fi
532
		# only needed on the main node
Holger Levsen's avatar
Holger Levsen committed
533
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
534
			$UP2DATE || sudo apt-get install -t jessie-backports jenkins-job-builder || echo "this should only fail on the first install"
Holger Levsen's avatar
Holger Levsen committed
535
		elif [ "$HOSTNAME" = "jenkins" ] ; then
536
			$UP2DATE || sudo apt-get install -t jessie-backports ffmpeg libav-tools python3-popcon jenkins-job-builder dose-extra
537
		fi
Holger Levsen's avatar
Holger Levsen committed
538
		explain "packages installed."
539
	else
Holger Levsen's avatar
Holger Levsen committed
540
		explain "no new packages to be installed."
541
	fi
542
fi
543

544
#
Holger Levsen's avatar
Holger Levsen committed
545
# deploy package configuration in /etc and /usr
546
#
Holger Levsen's avatar
Holger Levsen committed
547
cd $BASEDIR
548
sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/etc/* /etc
Holger Levsen's avatar
Holger Levsen committed
549
sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/usr/* /usr
550
551
552
553
554

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
555
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
556
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
557
558

if [ "$HOSTNAME" = "jenkins" ] ; then
559
560
561
562
563
564
565
566
567
568
569
570
	if [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ] || [ ! -f $STAMP ] ; then
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
		sudo a2ensite -q jenkins.debian.net
		sudo a2enconf -q munin
571
		sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
572
573
574
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
575
	fi
576
577
578
579
580
581
	if ! grep controlmaster ~jenkins/.ssh/config || ! grep controlpath ~jenkins/.ssh/config ; then
		echo
		echo "Please define controlmaster and controlpath in ~jenkins/.ssh/config manually, see https://debian-administration.org/article/290/Reusing_existing_OpenSSH_v4_connections"
		echo
		exit 1
	fi
582
583
fi

584
if [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] || [ ! -f $STAMP ] ; then
585
	cd /etc/munin/plugins
Holger Levsen's avatar
Holger Levsen committed
586
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* 2>/dev/null
587
	case $HOSTNAME in
Holger Levsen's avatar
Holger Levsen committed
588
			jenkins|profitbricks-build*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
589
590
			*)	;;
	esac
Holger Levsen's avatar
Holger Levsen committed
591
592
593
594
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
595
596
597
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
598
599
	if [ "$HOSTNAME" = "jenkins" ] && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
600
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
601
	fi
602
	sudo service munin-node restart
603
fi
Holger Levsen's avatar
Holger Levsen committed
604
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
605
606
607
608

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
609
cd $BASEDIR
610
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
611
for dir in bin logparse cucumber live mustache-templates ; do
612
613
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
614
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
615
done
616
617
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
618
	sudo rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
619
620
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
else
Philip Hands's avatar
Philip Hands committed
621
622
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
623
624
fi

625

Holger Levsen's avatar
Holger Levsen committed
626
sudo mkdir -p /var/lib/jenkins/.ssh
627
628
629
630
631
632
if [ "$HOSTNAME" = "jenkins" ] ; then
	sudo cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
	sudo cp jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
Holger Levsen's avatar
Holger Levsen committed
633
634
635
sudo chown -R jenkins:jenkins /var/lib/jenkins/.ssh
sudo chmod 700 /var/lib/jenkins/.ssh
sudo chmod 600 /var/lib/jenkins/.ssh/authorized_keys
Holger Levsen's avatar
Holger Levsen committed
636
explain "scripts and configurations for jenkins updated."
637

638
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
639
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
640
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
641
	echo "----" >> $TMPFILE
642
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
Holger Levsen's avatar
Holger Levsen committed
643
644
	# samuel, lunar, josch and phil committed with several commiters, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
645
	rm $TMPFILE
646
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
647
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
648
649
650
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
651
652
653
654
655
656
657
658
659
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
660
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
661
	explain "user content for jenkins updated."
662
fi
663

664
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
665
666
667
668
669
670
671
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
	# there are both python2 and python3 scripts here
Philip Hands's avatar
Philip Hands committed
672
		[ -e ./$metaconfig ] || continue
673
		./$metaconfig > $TMPFILE
674
675
		if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} - < $TMPFILE ; then
			sudo -u jenkins-adm tee ${metaconfig%.py} > /dev/null < $TMPFILE
676
677
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
678
	rm -f $TMPFILE
679
	for config in *.yaml ; do
680
681
682
683
684
685
686
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
687
			$JJB update $config
688
689
690
691
		else
			echo "$config has not changed, nothing to do."
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
692
	explain "jenkins jobs updated."
693
fi
694

695
#
Holger Levsen's avatar
Holger Levsen committed
696
# configure git for jenkins
697
#
Holger Levsen's avatar
Holger Levsen committed
698
699
700
701
if [ "$(sudo su - jenkins -c 'git config --get user.email')" != "jenkins@jenkins.debian.net" ] ; then
	sudo su - jenkins -c "git config --global user.email jenkins@jenkins.debian.net"
	sudo su - jenkins -c "git config --global user.name Jenkins"
fi
Holger Levsen's avatar
Holger Levsen committed
702

703
704
705
706
707
if [ "$HOSTNAME" = "jenkins" ] ; then
	#
	# creating LVM volume group for jobs
	#
	if [ "$PVNAME" = "" ]; then
Philip Hands's avatar
Philip Hands committed
708
709
710
		figlet -f banner Error
		explain "you must set \$PVNAME to physical volume pathname, exiting."
		exit 1
Holger Levsen's avatar
Holger Levsen committed
711
	elif ! $UP2DATE ; then
Philip Hands's avatar
Philip Hands committed
712
713
714
715
716
717
		if ! sudo pvs $PVNAME >/dev/null 2>&1; then
			sudo pvcreate $PVNAME
		fi
		if ! sudo vgs $VGNAME >/dev/null 2>&1; then
			sudo vgcreate $VGNAME $PVNAME
		fi
718
	fi
719
720
721
722
723
fi

#
# generate the kgb-client configurations
#
724
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
725
726
727
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
Philip Hands's avatar
Philip Hands committed
728
		# the last condition is to assure the files are owned by the right user/team
729
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
Philip Hands's avatar
Philip Hands committed
730
731
732
733
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
734
	else
Philip Hands's avatar
Philip Hands committed
735
736
737
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
738
739
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
740
	fi
741
742
fi

743
744
745
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
746
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
747
	explain "$(date) - Not generating GPG key as one already exists for jenkins user."
748
else
Holger Levsen's avatar
Holger Levsen committed
749
	explain "$(date) - Generating GPG key for jenkins user."
750

751
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
752
753
754
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
755
Name-Real: $HOSTNAME
756
757
758
759
760
761
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
762

763
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
764
765
766
767
768
769

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
770
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
771
	fi
772
773
fi

Holger Levsen's avatar
Holger Levsen committed
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
#
# There's always some work left...
#	echo FIXME is ignored so check-jobs scripts can output templates requiring manual work
#
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
	rgrep FI[X]ME $BASEDIR/* | grep -v echo > $TMPFILE || true
	if [ -s $TMPFILE ] ; then
		echo
		# only show cucumber FIXMEs when deploying on jenkins-test-vm
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			cat $TMPFILE
		else
			cat $TMPFILE | grep -v cucumber
		fi
		echo
	fi
	rm -f $TMPFILE
fi

793
#
794
# almost finally…
795
#
796
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
797
explain "$(date) - finished deployment."
798

799
# finally!
800
case $HOSTNAME in
801
	# set time back to the future
802
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
803
		disable_dsa_check_packages
804
805
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
806
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
807
		disable_dsa_check_packages
808
809
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
810
	jenkins)
811
		# notify irc on updates of jenkins.d.n
812
813
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
Holger Levsen's avatar
Holger Levsen committed
814
		;;
815
816
	*)	;;
esac
817
818
819
820

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
821
822
echo "__$HOSTNAME=ok__"