update_jdn.sh 24.6 KB
Newer Older
1
#!/bin/bash
2
# Copyright 2012-2017 Holger Levsen <holger@layer-acht.org>
3
4
# released under the GPLv=2

5
6
set -e

7
BASEDIR="$(dirname "$(readlink -e $0)")"
8
9
PVNAME=/dev/vdb      # LVM physical volume for jobs
VGNAME=jenkins01     # LVM volume group
10
STAMP=/var/log/jenkins/update-jenkins.stamp
11
TMPFILE=$(mktemp)
12
13
14
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
JJB="jenkins-job-builder $@"
15
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
16

17
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
18
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
19
	UP2DATE=true
Philip Hands's avatar
Philip Hands committed
20
21
else
	UP2DATE=false
22
23
24
fi


Holger Levsen's avatar
Holger Levsen committed
25
explain() {
Holger Levsen's avatar
Holger Levsen committed
26
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
27
28
}

29
30
31
32
33
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
		sudo ntpdate -b de.pool.ntp.org
}
34

35
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
36
explain "$(date) - begin deployment update."
37

38
# some nodes need special treatment…
39
case $HOSTNAME in
40
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
41
		# set correct date
42
		set_correct_date
43
		;;
44
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
45
		# set correct date
46
		set_correct_date
Holger Levsen's avatar
Holger Levsen committed
47
		;;
48
49
50
	*)	;;
esac

51
52
53
#
# set up users and groups
#
54
if ! getent passwd jenkins > /dev/null ; then
55
	sudo addgroup --system jenkins
56
	sudo adduser --system --shell /bin/bash --home /var/lib/jenkins --ingroup jenkins --disabled-login jenkins
57
fi
Holger Levsen's avatar
Holger Levsen committed
58
if ! getent group jenkins-adm > /dev/null ; then
59
60
	sudo addgroup --system jenkins-adm
fi
61
if ! getent passwd jenkins-adm > /dev/null  ; then
Holger Levsen's avatar
Holger Levsen committed
62
	sudo adduser --system --shell /bin/bash --home /home/jenkins-adm --ingroup jenkins-adm --disabled-login jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
63
	sudo usermod -G jenkins jenkins-adm
64
fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
65
if [ ! -d /home/jenkins-adm ]; then
Mattia Rizzolo's avatar
Mattia Rizzolo committed
66
67
68
    sudo mkdir /home/jenkins-adm
    sudo chown jenkins-adm.jenkins-adm /home/jenkins-adm
fi
69

70
71

declare -A user_host_groups u_shell
72
73

sudo_groups='jenkins,jenkins-adm,sudo,adm'
74
75
76
77
78
79
80
81
82

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
# and add checks for the GROUP version whereever the HOSTNAME is checked in the following code

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
83
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
84
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
Philip Hands's avatar
Philip Hands committed
85
user_host_groups['phil','profitbricks-build10-amd64']="$sudo_groups"
86
user_host_groups['phil','jenkins']="$sudo_groups"
87
user_host_groups['lunar','jenkins']='reproducible'
88
89
user_host_groups['lynxis','profitbricks-build3-amd64']="$sudo_groups"
user_host_groups['lynxis','profitbricks-build4-amd64']="$sudo_groups"
90
user_host_groups['hans','profitbricks-build7-amd64']="$sudo_groups"
91
92
user_host_groups['vagrant','armhf']="$sudo_groups"
user_host_groups['vagrant','arm64']="$sudo_groups"
93

94
95

u_shell['mattia']='/bin/zsh'
96
u_shell['lynxis']='/bin/fish'
97
u_shell['jenkins-adm']='/bin/bash'
98

99
100
101
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

102
( $UP2DATE && [ -z $(find authorized_keys -newer $0) ] ) || for user in ${users}; do
103
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
104
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
105
106
		continue
	fi
107

108
109
110
111
112
113
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
114
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
115
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
116
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
117
			break
118
		fi
119
120
121
122
123
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
124
	fi
125
126
done

127
# change defaults
128
129
130
$UP2DATE || grep -q '^AuthorizedKeysFile' /etc/ssh/sshd_config || {
	sudo sh -c "echo 'AuthorizedKeysFile /var/lib/misc/userkeys/%u %h/.ssh/authorized_keys' >> /etc/ssh/sshd_config"
	sudo service ssh reload
131
}
132
133
134
135
136
# change vagrants manual configuration on some armhf hosts
$UP2DATE || grep -q '/var/lib/misc/userkeys' /etc/ssh/sshd_config || {
	sudo sed -i "s#/var/lib/monkeysphere/authorized_keys/#/var/lib/misc/userkeys/#g" /etc/ssh/sshd_config
	sudo service ssh reload
}
137

138
139
140
141
142
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

143
if [ "$HOSTNAME" = "jenkins-test-vm" ] || [ "$HOSTNAME" = "profitbricks-build10-amd64" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
144
	# jenkins needs access to libvirt
145
	sudo adduser jenkins kvm
146
147
148
	sudo adduser jenkins libvirt
	sudo adduser jenkins libvirt-qemu

149
	# we need a directory for the VM's storage pools
150
	VM_POOL_DIR=/srv/lvc/vm-pools
151
	if [ ! -d $VM_POOL_DIR ] ; then
152
		sudo mkdir -p $VM_POOL_DIR
153
154
155
		sudo chown jenkins:libvirt-qemu $VM_POOL_DIR
		sudo chmod 775 $VM_POOL_DIR
	fi
156
157
158
159
160
161

	# tidy up after ourselves, for a while at least
	OLD_VM_POOL_DIR=/srv/workspace/vm-pools
	if [ -d "$OLD_VM_POOL_DIR" ] ; then
		sudo rm -r "$OLD_VM_POOL_DIR"
	fi
162
fi
163

164
165
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
166
167
168
169
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
Holger Levsen's avatar
Holger Levsen committed
170
	profitbricks-build9-amd64)
171
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
172
173
		TMPSIZE=8
		;;
Holger Levsen's avatar
Holger Levsen committed
174
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
175
176
177
		TMPFSSIZE=200
		TMPSIZE=15
		;;
178
179
180
181
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
182
183
184
	*) ;;
esac
case $HOSTNAME in
185
186
187
188
189
190
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
191
	jenkins|profitbricks-build*amd64|codethink*)
192
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
193
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
194
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
195
196
197
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
198
199
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
200
				sudo mount /srv/workspace
201
			else
202
				explain "WARNING: mountpoint /srv/workspace is non-empty."
203
204
205
206
207
			fi
		fi
		;;
	*) ;;
esac
208
case $HOSTNAME in
209
	profitbricks-build10-amd64)
210
211
212
213
214
215
216
217
218
219
220
221
222
223
		[ -d /srv/lvc/vm-pools ] || sudo mkdir -p /srv/lvc/vm-pools
		if ! grep -q '^/dev/vdb\s\+/srv/lvc/vm-pools\s' /etc/fstab; then
			echo "/dev/vdb	/srv/lvc/vm-pools ext4	errors=remount-ro	0	2" | sudo tee -a /etc/fstab >/dev/null  
		fi
		if ! mountpoint -q /srv/lvc/vm-pools; then
			if test -z "$(ls -A /srv/lvc/vm-pools)"; then
				sudo mount /srv/lvc/vm-pools
			else
				explain "WARNING: mountpoint /srv/lvc/vm-pools is non-empty."
			fi
		fi
		;;
	*) ;;
esac
224

225
# make sure needed directories exists - some directories will not be needed on all hosts...
226
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /srv/live-build /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
227
228
229
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
Holger Levsen's avatar
Holger Levsen committed
230
	sudo chown jenkins.jenkins $directory
231
done
Holger Levsen's avatar
Holger Levsen committed
232
for directory in /srv/jenkins ; do
233
234
235
236
237
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
238

239
if ! test -h /chroots; then
Holger Levsen's avatar
Holger Levsen committed
240
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
241
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
242
		explain "/chroots could not be cleared."
243
	else
244
		sudo ln -s /srv/workspace/chroots /chroots
245
246
247
	fi
fi

248
249
250
251
252
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
253
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
Holger Levsen's avatar
Holger Levsen committed
254
255
		DEBS=" 
			bash-completion 
256
257
			bc
			bsd-mailx
258
259
			curl
			debian-archive-keyring
260
			debootstrap 
261
262
			devscripts
			eatmydata
263
			etckeeper
264
			figlet
Holger Levsen's avatar
Holger Levsen committed
265
			git
266
			haveged
Holger Levsen's avatar
Holger Levsen committed
267
			htop
268
			less
269
			lintian
270
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
271
			lsof
272
273
			molly-guard
			moreutils
274
			munin-node
275
276
			munin-plugins-extra
			netcat-traditional
277
278
			ntp
			ntpdate
279
			pigz 
280
			postfix
281
			procmail
282
			psmisc
283
			python3-psycopg2 
Holger Levsen's avatar
Holger Levsen committed
284
			schroot 
285
286
			screen
			slay
287
			stunnel
Holger Levsen's avatar
Holger Levsen committed
288
289
290
291
292
			subversion 
			subversion-tools 
			sudo 
			unzip 
			vim 
293
			zsh
294
			"
295
		# install squid everywhere except on the armhf nodes
296
		case $HOSTNAME in
297
			jenkins|jenkins-test-vm|profitbricks-build*|codethink*) DEBS="$DEBS
298
				squid3
299
300
				kgb-client
				python3-yaml" ;;
301
302
			*) ;;
		esac
303
304
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
305
			profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
306
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
307
308
			*) ;;
		esac
309
		# needed to run coreboot/openwrt/lede/netbsd/fedora jobs
310
		case $HOSTNAME in
311
			profitbricks-build3-amd64|profitbricks-build4-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
312
				bison
313
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
314
315
316
				cmake
				diffutils
				findutils
317
				fish
Holger Levsen's avatar
Holger Levsen committed
318
319
320
321
322
323
324
325
326
327
328
329
330
331
				flex
				g++
				gawk
				gcc
				git
				grep
				iasl
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
332
333
				python3-clint
				python3-git
334
				python3-pystache
335
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
336
337
				python3-yaml
				subversion
338
				sysvinit-core
339
				tree
Holger Levsen's avatar
Holger Levsen committed
340
341
342
				unzip
				util-linux
				zlib1g-dev"
343
344
345
			;;
			*) ;;
		esac
346
347
348
		# needed to run fdroid jobs
		case $HOSTNAME in
			profitbricks-build7-amd64) DEBS="$DEBS
349
				android-sdk
350
				fdroidserver
351
				libvirt-clients
352
353
				libvirt-daemon
				libvirt-daemon-system
354
				python3-libvirt
355
				python3-vagrant
356
				qemu-kvm
357
358
359
				vagrant
				vagrant-mutate
				vagrant-libvirt"
360
			;;
361
362
			*) ;;
		esac
363
		# cucumber dependencies (for lvc jobs)
364
365
366
367
368
		case $HOSTNAME in
			profitbricks-build10-amd64|jenkins-test-vm) DEBS="$DEBS
				cucumber
				tesseract-ocr
				i18nspector
Holger Levsen's avatar
Holger Levsen committed
369
				imagemagick
370
371
				libav-tools
				libsikuli-script-java
372
				libvirt-bin
373
374
375
376
				libvirt-dev
				ovmf
				python-jabberbot
				python-potr
377
				python3-yaml
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
				ruby-guestfs
				ruby-libvirt
				ruby-net-irc
				ruby-packetfu
				ruby-rb-inotify
				ruby-rjb
				ruby-test-unit
				tcpdump
				unclutter
				virt-viewer
				x264
				xvfb
				x11vnc"
			   ;;
			*) ;;
		esac
394
395
396
397
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
		fi
398
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
399
400
401
402
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
403
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
404
405
406
407
408
409
410
411
412
413
				binfmt-support 
				bison 
				build-essential 
				calamaris 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
414
				flex
Holger Levsen's avatar
Holger Levsen committed
415
				gawk 
416
417
				ghc
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
418
419
420
421
				gocr 
				graphviz 
				iasl 
				imagemagick 
422
423
				ip2host
				jekyll
424
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
425
426
427
428
429
430
431
432
433
434
				libapache2-mod-macro 
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libvirt0 
				libvirt-bin 
				libvpx1 
				libxslt1-dev 
435
				linux-image-amd64
Holger Levsen's avatar
Holger Levsen committed
436
437
438
439
440
441
442
443
				moreutils 
				mr 
				mtr-tiny 
				munin 
				ntp 
				openbios-ppc 
				openbios-sparc 
				openjdk-7-jre 
444
				pandoc
445
				postgresql
446
				postgresql-autodoc
Holger Levsen's avatar
Holger Levsen committed
447
448
449
450
				postgresql-client-9.4 
				poxml 
				procmail 
				python3-debian 
451
				python3-pystache
452
453
454
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
				python-arpy 
				python-hachoir-metadata 
				python-imaging 
				python-lzma 
				python-pip 
				python-rpy2 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
				ruby-json 
				ruby-rspec 
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
				syslinux 
476
				tor
Holger Levsen's avatar
Holger Levsen committed
477
				vncsnapshot 
478
479
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
480
				x11-apps 
481
				xtightvncviewer
482
				xvfb
483
				xvkbd
484
				zutils"
485
486
487
		else
			MASTERDEBS=""
		fi
488
		$UP2DATE || ( sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/etc/apt/sources.list /etc/apt ; sudo apt-get update )
489
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
490
		# dont (re-)install pbuilder if it's on hold
491
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
492
493
494
495
496
497
498
499
			case $HOSTNAME in
				codethink*) 	$UP2DATE || sudo apt-get install -t jessie-backports pbuilder
						;;
				*)		$UP2DATE || sudo apt-get install -t jessie-backports \
							pbuilder lintian || echo "this should only fail on the first install"
				;;
			esac
		fi
500
		# remove unattended-upgrades if it's installed
501
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
502
			 sudo apt-get -y purge unattended-upgrades
503
		fi
504
		# we need mock from bpo to build current fedora
505
506
		if [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
			$UP2DATE || sudo apt-get install -t jessie-backports mock \
507
				|| echo "this should only fail on the first install"
508
		fi
509
510
511
512
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default i386 kernel on pb-build2+12-i386)
		# - we use the default amd64 kernel on pb-build1+11 (and the default amd64 kernel on pb-build6+16-i386)
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] ; then
513
			$UP2DATE || sudo apt-get install -t jessie-backports linux-image-amd64 || echo "this should only fail on the first install"
514
515
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] ; then
			$UP2DATE || sudo apt-get install linux-image-amd64
516
		fi
517
		# only needed on the main node
Holger Levsen's avatar
Holger Levsen committed
518
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
519
			$UP2DATE || sudo apt-get install -t jessie-backports jenkins-job-builder || echo "this should only fail on the first install"
Holger Levsen's avatar
Holger Levsen committed
520
		elif [ "$HOSTNAME" = "jenkins" ] ; then
521
			$UP2DATE || sudo apt-get install -t jessie-backports ffmpeg libav-tools python3-popcon jenkins-job-builder dose-extra
522
		fi
Holger Levsen's avatar
Holger Levsen committed
523
		explain "packages installed."
524
	else
Holger Levsen's avatar
Holger Levsen committed
525
		explain "no new packages to be installed."
526
	fi
527
fi
528

529
#
Holger Levsen's avatar
Holger Levsen committed
530
# deploy package configuration in /etc and /usr
531
#
Holger Levsen's avatar
Holger Levsen committed
532
cd $BASEDIR
533
sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/etc/* /etc
Holger Levsen's avatar
Holger Levsen committed
534
sudo cp --preserve=mode,timestamps -r hosts/$HOSTNAME/usr/* /usr
535
536
537
538
539

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
540
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
541
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
542
543

if [ "$HOSTNAME" = "jenkins" ] ; then
544
545
546
547
548
549
550
551
552
553
554
555
	if [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ] || [ ! -f $STAMP ] ; then
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
		sudo a2ensite -q jenkins.debian.net
		sudo a2enconf -q munin
556
		sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
557
558
559
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
560
	fi
561
562
563
564
565
566
	if ! grep controlmaster ~jenkins/.ssh/config || ! grep controlpath ~jenkins/.ssh/config ; then
		echo
		echo "Please define controlmaster and controlpath in ~jenkins/.ssh/config manually, see https://debian-administration.org/article/290/Reusing_existing_OpenSSH_v4_connections"
		echo
		exit 1
	fi
567
568
fi

569
if [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] || [ ! -f $STAMP ] ; then
570
	cd /etc/munin/plugins
Holger Levsen's avatar
Holger Levsen committed
571
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* 2>/dev/null
572
	case $HOSTNAME in
Holger Levsen's avatar
Holger Levsen committed
573
			jenkins|profitbricks-build*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
574
575
			*)	;;
	esac
Holger Levsen's avatar
Holger Levsen committed
576
577
578
579
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
580
581
582
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
583
584
	if [ "$HOSTNAME" = "jenkins" ] && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
585
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
586
	fi
587
	sudo service munin-node restart
588
fi
Holger Levsen's avatar
Holger Levsen committed
589
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
590
591
592
593

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
594
cd $BASEDIR
595
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
596
for dir in bin logparse cucumber live mustache-templates ; do
597
598
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
599
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
600
done
601
602
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
603
	sudo rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
604
605
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
else
Philip Hands's avatar
Philip Hands committed
606
607
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
608
609
fi

610

Holger Levsen's avatar
Holger Levsen committed
611
sudo mkdir -p /var/lib/jenkins/.ssh
612
613
614
615
616
617
if [ "$HOSTNAME" = "jenkins" ] ; then
	sudo cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
	sudo cp jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
Holger Levsen's avatar
Holger Levsen committed
618
619
620
sudo chown -R jenkins:jenkins /var/lib/jenkins/.ssh
sudo chmod 700 /var/lib/jenkins/.ssh
sudo chmod 600 /var/lib/jenkins/.ssh/authorized_keys
Holger Levsen's avatar
Holger Levsen committed
621
explain "scripts and configurations for jenkins updated."
622

623
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
624
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
625
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
626
	echo "----" >> $TMPFILE
627
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
Holger Levsen's avatar
Holger Levsen committed
628
629
	# samuel, lunar, josch and phil committed with several commiters, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
630
	rm $TMPFILE
631
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
632
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
633
634
635
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
636
637
638
639
640
641
642
643
644
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
645
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
646
	explain "user content for jenkins updated."
647
fi
648

649
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
650
651
652
653
654
655
656
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
	# there are both python2 and python3 scripts here
Philip Hands's avatar
Philip Hands committed
657
		[ -e ./$metaconfig ] || continue
658
		./$metaconfig > $TMPFILE
659
660
		if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} - < $TMPFILE ; then
			sudo -u jenkins-adm tee ${metaconfig%.py} > /dev/null < $TMPFILE
661
662
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
663
	rm -f $TMPFILE
664
	for config in *.yaml ; do
665
666
667
668
669
670
671
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
672
			$JJB update $config
673
674
675
676
		else
			echo "$config has not changed, nothing to do."
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
677
	explain "jenkins jobs updated."
678
fi
679

680
#
Holger Levsen's avatar
Holger Levsen committed
681
# configure git for jenkins
682
#
Holger Levsen's avatar
Holger Levsen committed
683
684
685
686
if [ "$(sudo su - jenkins -c 'git config --get user.email')" != "jenkins@jenkins.debian.net" ] ; then
	sudo su - jenkins -c "git config --global user.email jenkins@jenkins.debian.net"
	sudo su - jenkins -c "git config --global user.name Jenkins"
fi
Holger Levsen's avatar
Holger Levsen committed
687

688
689
690
691
692
if [ "$HOSTNAME" = "jenkins" ] ; then
	#
	# creating LVM volume group for jobs
	#
	if [ "$PVNAME" = "" ]; then
Philip Hands's avatar
Philip Hands committed
693
694
695
		figlet -f banner Error
		explain "you must set \$PVNAME to physical volume pathname, exiting."
		exit 1
Holger Levsen's avatar
Holger Levsen committed
696
	elif ! $UP2DATE ; then
Philip Hands's avatar
Philip Hands committed
697
698
699
700
701
702
		if ! sudo pvs $PVNAME >/dev/null 2>&1; then
			sudo pvcreate $PVNAME
		fi
		if ! sudo vgs $VGNAME >/dev/null 2>&1; then
			sudo vgcreate $VGNAME $PVNAME
		fi
703
	fi
704
705
706
707
708
fi

#
# generate the kgb-client configurations
#
709
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build3-amd64" ] || [ "$HOSTNAME" = "profitbricks-build4-amd64" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
710
711
712
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
Philip Hands's avatar
Philip Hands committed
713
		# the last condition is to assure the files are owned by the right user/team
714
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
Philip Hands's avatar
Philip Hands committed
715
716
717
718
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
719
	else
Philip Hands's avatar
Philip Hands committed
720
721
722
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
723
724
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
725
	fi
726
727
fi

728
729
730
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
731
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
732
	explain "$(date) - Not generating GPG key as one already exists for jenkins user."
733
else
Holger Levsen's avatar
Holger Levsen committed
734
	explain "$(date) - Generating GPG key for jenkins user."
735

736
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
737
738
739
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
740
Name-Real: $HOSTNAME
741
742
743
744
745
746
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
747

748
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
749
750
751
752
753
754

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
755
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
756
	fi
757
758
fi

Holger Levsen's avatar
Holger Levsen committed
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
#
# There's always some work left...
#	echo FIXME is ignored so check-jobs scripts can output templates requiring manual work
#
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
	rgrep FI[X]ME $BASEDIR/* | grep -v echo > $TMPFILE || true
	if [ -s $TMPFILE ] ; then
		echo
		# only show cucumber FIXMEs when deploying on jenkins-test-vm
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			cat $TMPFILE
		else
			cat $TMPFILE | grep -v cucumber
		fi
		echo
	fi
	rm -f $TMPFILE
fi

778
#
779
# almost finally…
780
#
781
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
782
explain "$(date) - finished deployment."
783

784
# finally!
785
case $HOSTNAME in
786
	# set time back to the future
787
	profitbricks-build4-amd64|profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
788
789
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
790
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
791
792
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
793
	jenkins)
794
		# notify irc on updates of jenkins.d.n
795
796
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
Holger Levsen's avatar
Holger Levsen committed
797
		;;
798
799
	*)	;;
esac
800
801
802
803

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
804
805
echo "__$HOSTNAME=ok__"