update_jdn.sh 24.1 KB
Newer Older
1
#!/bin/bash
2
# vim: set noexpandtab:
3
# Copyright 2012-2018 Holger Levsen <holger@layer-acht.org>
4
#         ©      2018 Mattia Rizzolo <mattia@debian.org>
5
6
# released under the GPLv=2

Holger Levsen's avatar
Holger Levsen committed
7
# puppet / salt / ansible / fai / chef / deployme.app - disclaimer
Holger Levsen's avatar
Holger Levsen committed
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# (IOW: this script has been grown in almost 500 commits and it shows…)
#
# yes, we know… and: "it" should probably still be done.
#
# It just unclear, how/what, and what we have actually mostly works.
#
# Switching to jenkins.debian.org is probably an opportunity
# to write (refactor this into) *yet another deployment script*
# (interacting with the DSA machine setup which is in puppet…),
# thus obsoleting this script gradually, though this is used on
# 47 hosts currently (of which quite some were initially installed
# manully…)
#
# so, yes, patches welcome. saying this is crap alone is not helpful,
# nor is just suggesting some new or old technology. patches most welcome!
23
24
#
# that said, there's a new one: init_node ;)
Holger Levsen's avatar
Holger Levsen committed
25

26
27
set -e

28
BASEDIR="$(dirname "$(readlink -e $0)")"
29
30
PVNAME=/dev/vdb      # LVM physical volume for jobs
VGNAME=jenkins01     # LVM volume group
31
STAMP=/var/log/jenkins/update-jenkins.stamp
32
33
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
34
JJB="jenkins-jobs $@"
35
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
36

37
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
38
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
39
	UP2DATE=true
Philip Hands's avatar
Philip Hands committed
40
41
else
	UP2DATE=false
42
43
44
fi


Holger Levsen's avatar
Holger Levsen committed
45
explain() {
Holger Levsen's avatar
Holger Levsen committed
46
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
47
48
}

49
50
51
52
53
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
		sudo ntpdate -b de.pool.ntp.org
}
54

55
disable_dsa_check_packages() {
56
	# disable check for outdated packages as someday in the future
57
	# packages from security.d.o will appear outdated always…
58
59
	echo -e "#!/bin/sh\n# disabled dsa-check by update_jdn.sh\nexit 0" | sudo tee /usr/local/bin/dsa-check-packages
	sudo chmod a+rx /usr/local/bin/dsa-check-packages
60
61
}

62
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
63
explain "$(date) - begin deployment update."
64

65
66
67
68
#
# temporarily test to check which hosts don't use systemd
#
if [ -z "$(dpkg -l|grep systemd-sysv||true)" ] ; then 
69
	echo "no systemd-sysv installed on $(hostname), please enter to continue…"
70
71
72
	read
fi

73
# some nodes need special treatment…
74
case $HOSTNAME in
75
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
76
		# set correct date
77
		set_correct_date
78
		;;
79
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
80
		# set correct date
81
		set_correct_date
Holger Levsen's avatar
Holger Levsen committed
82
		;;
83
84
85
	*)	;;
esac

86
87
88
89
90
91
92
93
94
95
96
# ubuntu decided to change kernel perms in the middle of LTS…
case $HOSTNAME in
	codethink-sled*)
		# fixup perms
		sudo chmod +r /boot/vmlinuz-*
		;;
	*)	;;
esac



97
98
99
#
# set up users and groups
#
100
declare -A user_host_groups u_shell
101
sudo_groups='jenkins,jenkins-adm,sudo,adm'
102
103
104
105
106
107
108
109
110

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
# and add checks for the GROUP version whereever the HOSTNAME is checked in the following code

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
111
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
112
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
113
user_host_groups['phil','jenkins']="$sudo_groups"
114
user_host_groups['lunar','jenkins']='reproducible'
115
116
user_host_groups['lynxis','profitbricks-build3-amd64']="$sudo_groups"
user_host_groups['lynxis','profitbricks-build4-amd64']="$sudo_groups"
117
user_host_groups['hans','profitbricks-build7-amd64']="$sudo_groups"
118
119
user_host_groups['vagrant','armhf']="$sudo_groups"
user_host_groups['vagrant','arm64']="$sudo_groups"
120

121
122

u_shell['mattia']='/bin/zsh'
123
u_shell['lynxis']='/bin/fish'
124
u_shell['jenkins-adm']='/bin/bash'
125

126
127
128
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

129
( $UP2DATE && [ -z "$(find authorized_keys -newer $0)" ] ) || for user in ${users}; do
130
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
131
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
132
133
		continue
	fi
134

135
136
137
138
139
140
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
141
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
142
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
143
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
144
			break
145
		fi
146
147
148
149
150
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
151
	fi
152
153
done

154
155
156
157
158
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

Mattia Rizzolo's avatar
Mattia Rizzolo committed
159
if [ "$HOSTNAME" = "jenkins-test-vm" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
160
	# jenkins needs access to libvirt
161
	sudo adduser jenkins kvm
162
163
	sudo adduser jenkins libvirt
	sudo adduser jenkins libvirt-qemu
164
fi
165

166
167
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
168
169
170
171
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
Holger Levsen's avatar
Holger Levsen committed
172
	profitbricks-build9-amd64)
173
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
174
175
		TMPSIZE=8
		;;
Holger Levsen's avatar
Holger Levsen committed
176
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
177
178
179
		TMPFSSIZE=200
		TMPSIZE=15
		;;
180
181
182
183
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
184
185
186
	*) ;;
esac
case $HOSTNAME in
187
188
189
190
191
192
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
193
	jenkins|profitbricks-build*amd64|codethink*)
194
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
195
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
196
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
197
198
199
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
200
201
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
202
				sudo mount /srv/workspace
203
			else
204
				explain "WARNING: mountpoint /srv/workspace is non-empty."
205
206
207
208
209
			fi
		fi
		;;
	*) ;;
esac
210

211
# make sure needed directories exists - some directories will not be needed on all hosts...
212
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /srv/live-build /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
213
214
215
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
Holger Levsen's avatar
Holger Levsen committed
216
	sudo chown jenkins.jenkins $directory
217
done
Holger Levsen's avatar
Holger Levsen committed
218
for directory in /srv/jenkins ; do
219
220
221
222
223
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
224

225
if ! test -h /chroots; then
Holger Levsen's avatar
Holger Levsen committed
226
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
227
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
228
		explain "/chroots could not be cleared."
229
	else
230
		sudo ln -s /srv/workspace/chroots /chroots
231
232
233
	fi
fi

234
235
236
237
238
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
239
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
Holger Levsen's avatar
Holger Levsen committed
240
241
		DEBS=" 
			bash-completion 
242
243
			bc
			bsd-mailx
244
245
			curl
			debian-archive-keyring
246
			debootstrap 
247
248
			devscripts
			eatmydata
249
			etckeeper
250
			figlet
Holger Levsen's avatar
Holger Levsen committed
251
			git
252
			haveged
Holger Levsen's avatar
Holger Levsen committed
253
			htop
254
			less
255
			lintian
256
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
257
			lsof
258
259
			molly-guard
			moreutils
260
			netcat-traditional
261
262
			ntp
			ntpdate
263
			pigz 
264
			postfix
265
			procmail
266
			psmisc
267
			python3-psycopg2 
Holger Levsen's avatar
Holger Levsen committed
268
			schroot 
269
270
			screen
			slay
271
			stunnel
Holger Levsen's avatar
Holger Levsen committed
272
273
			subversion 
			subversion-tools 
274
			systemd-sysv
Holger Levsen's avatar
Holger Levsen committed
275
276
277
			sudo 
			unzip 
			vim 
278
			zsh
279
			"
280
		# install squid everywhere except on the armhf nodes
281
		case $HOSTNAME in
282
			jenkins|jenkins-test-vm|profitbricks-build*|codethink*) DEBS="$DEBS
283
				squid
284
285
				kgb-client
				python3-yaml" ;;
286
287
			*) ;;
		esac
288
289
290
291
292
293
294
295
296
		# install munin from stretch-backports everywhere, except on ubuntu nodes
		case $HOSTNAME in
			codethink*) DEBS="$DEBS
				munin-node
				munin-plugins-extra" ;;
			*) 	DEBS="$DEBS
				munin-node/stretch-backports
				munin-plugins-extra/stretch-backports" ;;
		esac
297
298
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
299
			profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
300
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
301
302
			*) ;;
		esac
303
		# needed to run coreboot/openwrt/lede/netbsd/fedora jobs
304
		case $HOSTNAME in
305
		profitbricks-build3-amd64|profitbricks-build4-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
306
				bison
307
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
308
309
310
				cmake
				diffutils
				findutils
311
				fish
Holger Levsen's avatar
Holger Levsen committed
312
313
314
315
316
317
318
319
320
321
322
323
324
				flex
				g++
				gawk
				gcc
				grep
				iasl
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
325
326
				python3-clint
				python3-git
327
				python3-pystache
328
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
329
330
				python3-yaml
				subversion
331
				tree
Holger Levsen's avatar
Holger Levsen committed
332
333
334
				unzip
				util-linux
				zlib1g-dev"
335
336
337
			;;
			*) ;;
		esac
338
339
340
		# needed to run fdroid jobs
		case $HOSTNAME in
			profitbricks-build7-amd64) DEBS="$DEBS
341
				androguard/stretch-backports
342
				android-sdk
343
344
				bzr
				git-svn
345
				fdroidserver/stretch-backports
346
				libvirt-clients
347
348
				libvirt-daemon
				libvirt-daemon-system
349
				mercurial
350
				python3-libvirt
351
				python3-mwclient/stretch-backports
352
353
				python3-qrcode
				python3-ruamel.yaml
354
				python3-vagrant
355
				qemu-kvm
356
				subversion
357
358
359
				vagrant
				vagrant-mutate
				vagrant-libvirt"
360
			;;
361
			*) ;;
362
		esac
363
364
365
366
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
		fi
367
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
368
369
370
371
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
372
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
373
				binfmt-support 
374
375
				bison
				botch
Holger Levsen's avatar
Holger Levsen committed
376
377
378
379
380
381
382
				build-essential 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
383
				flex
Holger Levsen's avatar
Holger Levsen committed
384
				gawk 
385
				ghc
386
				git-lfs
387
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
388
389
390
391
				gocr 
				graphviz 
				iasl 
				imagemagick 
392
393
				ip2host
				jekyll
394
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
395
396
397
398
399
400
401
402
403
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libxslt1-dev 
				moreutils 
				mr 
				mtr-tiny 
404
				munin/stretch-backports
Holger Levsen's avatar
Holger Levsen committed
405
				ntp 
406
				obfs4proxy
Holger Levsen's avatar
Holger Levsen committed
407
408
				openbios-ppc 
				openbios-sparc 
Holger Levsen's avatar
Holger Levsen committed
409
				openjdk-8-jre 
410
				pandoc
411
				postgresql
412
				postgresql-autodoc
413
				postgresql-client 
Holger Levsen's avatar
Holger Levsen committed
414
415
416
				poxml 
				procmail 
				python3-debian 
417
				python3-pystache
418
				python3-requests
419
420
421
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
422
423
424
425
426
427
428
429
430
431
432
433
434
435
				python-arpy 
				python-hachoir-metadata 
				python-imaging 
				python-lzma 
				python-pip 
				python-rpy2 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
436
437
				ruby-rspec
				rustc
Holger Levsen's avatar
Holger Levsen committed
438
439
440
441
442
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
				syslinux 
443
				tor
Holger Levsen's avatar
Holger Levsen committed
444
				vncsnapshot 
445
446
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
447
				x11-apps 
448
				xtightvncviewer
449
				xvfb
450
				xvkbd
451
				zutils"
452
453
454
		else
			MASTERDEBS=""
		fi
455
		$UP2DATE || sudo apt-get update
456
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
457
		# dont (re-)install pbuilder if it's on hold
458
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
459
460
461
			case $HOSTNAME in
				codethink*) 	$UP2DATE || sudo apt-get install -t jessie-backports pbuilder
						;;
462
				*)		$UP2DATE || sudo apt-get install pbuilder lintian
463
464
465
				;;
			esac
		fi
466
		# remove unattended-upgrades if it's installed
467
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
468
			 sudo apt-get -y purge unattended-upgrades
469
		fi
470
		# we need mock to build fedora
471
		if [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
472
			$UP2DATE || sudo apt-get install mock
473
		fi
474
475
476
477
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default i386 kernel on pb-build2+12-i386)
		# - we use the default amd64 kernel on pb-build1+11 (and the default amd64 kernel on pb-build6+16-i386)
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] ; then
478
			$UP2DATE || sudo apt-get install linux-image-amd64
479
480
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] ; then
			$UP2DATE || sudo apt-get install linux-image-amd64
481
		fi
Holger Levsen's avatar
Holger Levsen committed
482
		# only needed on the main nodes
Holger Levsen's avatar
Holger Levsen committed
483
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
484
			$UP2DATE || sudo apt-get install jenkins-job-builder/stretch-backports
Holger Levsen's avatar
Holger Levsen committed
485
		elif [ "$HOSTNAME" = "jenkins" ] ; then
486
			$UP2DATE || sudo apt-get install ffmpeg libav-tools python3-popcon jenkins-job-builder/stretch-backports dose-extra
487
		fi
488
		sudo apt-get clean
Holger Levsen's avatar
Holger Levsen committed
489
		explain "packages installed."
490
	else
Holger Levsen's avatar
Holger Levsen committed
491
		explain "no new packages to be installed."
492
	fi
493
fi
494

495
#
Holger Levsen's avatar
Holger Levsen committed
496
# deploy package configuration in /etc and /usr
497
#
Holger Levsen's avatar
Holger Levsen committed
498
cd $BASEDIR
499
500
501
502
503
504
505
506
507
for h in common common-amd64 common-i386 common-arm64 common-armhf "$HOSTNAME" ; do
	# $HOSTNAME has precedence over common-$DPKG_ARCH over common
	case $h in
		common-amd64) [ $DPKG_ARCH = "amd64" ] || continue ;;
		common-i386)  [ $DPKG_ARCH = "i386" ] || continue ;;
		common-arm64) [ $DPKG_ARCH = "arm64" ] || continue ;;
		common-armhf) [ $DPKG_ARCH = "armhf" ] || continue ;;
		*) ;;
	esac
508
509
	if [ -d "hosts/$h/etc/sudoers.d/" ]; then
		for f in "hosts/$h/etc/sudoers.d/"* ; do
510
			/usr/sbin/visudo -c -f "$f" > /dev/null
511
512
513
		done
	fi
	for d in etc usr ; do
Mattia Rizzolo's avatar
Mattia Rizzolo committed
514
		if [ -d "hosts/$h/$d" ]; then
515
			sudo cp --preserve=mode,timestamps -r "hosts/$h/$d/"* "/$d"
516
517
518
		fi
	done
done
519
520
# we ship one or two service files…
sudo systemctl daemon-reload &
521
522
523
524
525

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
526
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
527
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
528
529

if [ "$HOSTNAME" = "jenkins" ] ; then
530
	if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ]  ; then
531
532
533
534
535
536
537
538
539
540
541
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
		sudo a2ensite -q jenkins.debian.net
		sudo a2enconf -q munin
542
		sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
543
544
545
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
546
	fi
547
548
549
550
551
552
	if ! grep controlmaster ~jenkins/.ssh/config || ! grep controlpath ~jenkins/.ssh/config ; then
		echo
		echo "Please define controlmaster and controlpath in ~jenkins/.ssh/config manually, see https://debian-administration.org/article/290/Reusing_existing_OpenSSH_v4_connections"
		echo
		exit 1
	fi
553
554
fi

555
if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] ; then
556
	cd /etc/munin/plugins
Holger Levsen's avatar
Holger Levsen committed
557
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* 2>/dev/null
558
	case $HOSTNAME in
559
			jenkins|profitbricks-build*|codethink-sled*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
560
561
			*)	;;
	esac
Holger Levsen's avatar
Holger Levsen committed
562
563
564
565
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
566
567
568
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
569
570
	if [ "$HOSTNAME" = "jenkins" ] && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
571
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
572
	fi
573
	sudo service munin-node restart
574
fi
Holger Levsen's avatar
Holger Levsen committed
575
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
576
577
578
579

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
580
cd $BASEDIR
581
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
582
# check for bash syntax *before* actually deploying anything
583
shopt -s nullglob
584
for f in bin/*.sh bin/**/*.sh ; do bash -n "$f" ; done
585
shopt -u nullglob
586
for dir in bin logparse live mustache-templates ; do
587
588
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
589
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
590
done
591
592
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
593
	sudo -u jenkins-adm rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
594
else
Philip Hands's avatar
Philip Hands committed
595
596
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
597
598
fi

599

Holger Levsen's avatar
Holger Levsen committed
600
sudo mkdir -p /var/lib/jenkins/.ssh
601
602
603
604
605
606
if [ "$HOSTNAME" = "jenkins" ] ; then
	sudo cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
	sudo cp jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
Holger Levsen's avatar
Holger Levsen committed
607
608
609
sudo chown -R jenkins:jenkins /var/lib/jenkins/.ssh
sudo chmod 700 /var/lib/jenkins/.ssh
sudo chmod 600 /var/lib/jenkins/.ssh/authorized_keys
Holger Levsen's avatar
Holger Levsen committed
610
explain "scripts and configurations for jenkins updated."
611

612
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
613
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
614
	TMPFILE=$(mktemp)
615
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
616
	echo "----" >> $TMPFILE
617
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
Holger Levsen's avatar
Holger Levsen committed
618
619
	# samuel, lunar, josch and phil committed with several commiters, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
620
	rm $TMPFILE
621
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
622
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
623
624
625
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
626
627
628
629
630
631
632
633
634
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
635
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
636
	explain "user content for jenkins updated."
637
fi
638

639
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
640
641
642
643
644
645
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
646
		TMPFILE=$(sudo -u jenkins-adm mktemp)
647
		./$metaconfig | sudo -u jenkins-adm tee "$TMPFILE" >/dev/null
648
		if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} "$TMPFILE" ; then
649
			sudo -u jenkins-adm mv "$TMPFILE" "${metaconfig%.py}"
650
651
652
		fi
	done
	for config in *.yaml ; do
653
654
655
656
657
658
659
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
660
			echo "$config has changed, executing updates."
661
			$JJB update $config
662
663
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
664
	explain "jenkins jobs updated."
665
fi
666

667
#
Holger Levsen's avatar
Holger Levsen committed
668
# configure git for jenkins
669
#
Holger Levsen's avatar
Holger Levsen committed
670
671
672
673
if [ "$(sudo su - jenkins -c 'git config --get user.email')" != "jenkins@jenkins.debian.net" ] ; then
	sudo su - jenkins -c "git config --global user.email jenkins@jenkins.debian.net"
	sudo su - jenkins -c "git config --global user.name Jenkins"
fi
Holger Levsen's avatar
Holger Levsen committed
674

675
676
677
678
679
if [ "$HOSTNAME" = "jenkins" ] ; then
	#
	# creating LVM volume group for jobs
	#
	if [ "$PVNAME" = "" ]; then
Philip Hands's avatar
Philip Hands committed
680
681
682
		figlet -f banner Error
		explain "you must set \$PVNAME to physical volume pathname, exiting."
		exit 1
Holger Levsen's avatar
Holger Levsen committed
683
	elif ! $UP2DATE ; then
Philip Hands's avatar
Philip Hands committed
684
685
686
687
688
689
		if ! sudo pvs $PVNAME >/dev/null 2>&1; then
			sudo pvcreate $PVNAME
		fi
		if ! sudo vgs $VGNAME >/dev/null 2>&1; then
			sudo vgcreate $VGNAME $PVNAME
		fi
690
	fi
691
692
693
694
695
fi

#
# generate the kgb-client configurations
#
696
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
697
698
699
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
Philip Hands's avatar
Philip Hands committed
700
		# the last condition is to assure the files are owned by the right user/team
701
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
Philip Hands's avatar
Philip Hands committed
702
703
704
705
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
706
	else
Philip Hands's avatar
Philip Hands committed
707
708
709
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
710
711
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
712
	fi
713
714
fi

715
716
717
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
718
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
719
	explain "$(date) - Not generating GPG key as one already exists for jenkins user."
720
else
Holger Levsen's avatar
Holger Levsen committed
721
	explain "$(date) - Generating GPG key for jenkins user."
722

723
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
724
725
726
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
727
Name-Real: $HOSTNAME
728
729
730
731
732
733
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
734

735
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
736
737
738
739
740
741

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
742
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
743
	fi
744
745
fi

Holger Levsen's avatar
Holger Levsen committed
746
747
748
749
750
#
# There's always some work left...
#	echo FIXME is ignored so check-jobs scripts can output templates requiring manual work
#
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
751
	TMPFILE=$(mktemp)
Holger Levsen's avatar
Holger Levsen committed
752
753
754
	rgrep FI[X]ME $BASEDIR/* | grep -v echo > $TMPFILE || true
	if [ -s $TMPFILE ] ; then
		echo
755
		cat $TMPFILE
Holger Levsen's avatar
Holger Levsen committed
756
757
		echo
	fi
758
	rm -f $TMPFILE
Holger Levsen's avatar
Holger Levsen committed
759
760
fi

761
#
762
# almost finally…
763
#
764
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
765
explain "$(date) - finished deployment."
766

767
# finally!
768
case $HOSTNAME in
769
	# set time back to the future
770
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
771
		disable_dsa_check_packages
772
773
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
774
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
775
		disable_dsa_check_packages
776
777
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
778
	jenkins)
779
		# notify irc on updates of jenkins.d.n
780
781
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
Holger Levsen's avatar
Holger Levsen committed
782
		;;
783
784
	*)	;;
esac
785
786
787
788

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
789
790
echo "__$HOSTNAME=ok__"