update_jdn.sh 25.6 KB
Newer Older
1
#!/bin/bash
2
# vim: set noexpandtab:
3
# Copyright 2012-2019 Holger Levsen <holger@layer-acht.org>
4
#         ©      2018 Mattia Rizzolo <mattia@debian.org>
5
6
# released under the GPLv=2

Holger Levsen's avatar
Holger Levsen committed
7
# puppet / salt / ansible / fai / chef / deployme.app - disclaimer
Holger Levsen's avatar
Holger Levsen committed
8
9
10
11
12
13
14
15
16
17
18
# (IOW: this script has been grown in almost 500 commits and it shows…)
#
# yes, we know… and: "it" should probably still be done.
#
# It just unclear, how/what, and what we have actually mostly works.
#
# Switching to jenkins.debian.org is probably an opportunity
# to write (refactor this into) *yet another deployment script*
# (interacting with the DSA machine setup which is in puppet…),
# thus obsoleting this script gradually, though this is used on
# 47 hosts currently (of which quite some were initially installed
Edward Betts's avatar
Edward Betts committed
19
# manually…)
Holger Levsen's avatar
Holger Levsen committed
20
21
22
#
# so, yes, patches welcome. saying this is crap alone is not helpful,
# nor is just suggesting some new or old technology. patches most welcome!
23
24
#
# that said, there's a new one: init_node ;)
Holger Levsen's avatar
Holger Levsen committed
25

26
27
set -e

28
BASEDIR="$(dirname "$(readlink -e $0)")"
29
STAMP=/var/log/jenkins/update-jenkins.stamp
30
31
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
32
JJB="jenkins-jobs $@"
33
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
34

35
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
36
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
37
	UP2DATE=true
Holger Levsen's avatar
Holger Levsen committed
38
	echo $HOSTNAME is up2date.
Philip Hands's avatar
Philip Hands committed
39
40
else
	UP2DATE=false
Holger Levsen's avatar
Holger Levsen committed
41
	echo $HOSTNAME needs to be updated.
42
43
44
fi


Holger Levsen's avatar
Holger Levsen committed
45
explain() {
Holger Levsen's avatar
Holger Levsen committed
46
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
47
48
}

49
50
51
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
52
		sudo ntpdate -b $1
53
}
54

55
disable_dsa_check_packages() {
56
	# disable check for outdated packages as someday in the future
57
	# packages from security.d.o will appear outdated always…
58
59
	echo -e "#!/bin/sh\n# disabled dsa-check by update_jdn.sh\nexit 0" | sudo tee /usr/local/bin/dsa-check-packages
	sudo chmod a+rx /usr/local/bin/dsa-check-packages
60
61
}

62
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
63
explain "$(date) - begin deployment update."
64

65
66
67
68
#
# temporarily test to check which hosts don't use systemd
#
if [ -z "$(dpkg -l|grep systemd-sysv||true)" ] ; then 
69
	echo "no systemd-sysv installed on $(hostname), please enter to continue…"
70
71
72
	read
fi

73
# some nodes need special treatment…
74
case $HOSTNAME in
75
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
76
		# set correct date
77
		set_correct_date de.pool.ntp.org
78
		;;
79
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
80
		# set correct date
81
		set_correct_date de.pool.ntp.org
Holger Levsen's avatar
Holger Levsen committed
82
		;;
83
	osuosl-build170-amd64|osuosl-build172-amd64)
84
		# set correct date
85
		set_correct_date time.osuosl.org
86
		;;
87
88
89
	*)	;;
esac

90
91
92
93
94
95
96
97
98
99
100
# ubuntu decided to change kernel perms in the middle of LTS…
case $HOSTNAME in
	codethink-sled*)
		# fixup perms
		sudo chmod +r /boot/vmlinuz-*
		;;
	*)	;;
esac



101
102
103
#
# set up users and groups
#
104
declare -A user_host_groups u_shell
105
sudo_groups='jenkins,jenkins-adm,sudo,adm'
106
107
108

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
109
# and add checks for the GROUP version where ever the HOSTNAME is checked in the following code
110
111
112
113
114

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
115
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
116
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
117
user_host_groups['phil','jenkins']="$sudo_groups"
118
user_host_groups['lunar','jenkins']='reproducible'
119
120
user_host_groups['lynxis','osuosl-build171-amd64']="$sudo_groups"
user_host_groups['lynxis','osuosl-build172-amd64']="$sudo_groups"
121
user_host_groups['lynxis','jenkins']="jenkins"
122
user_host_groups['hans','osuosl-build168-amd64']="$sudo_groups"
Mattia Rizzolo's avatar
Mattia Rizzolo committed
123
user_host_groups['vagrant','*']="$sudo_groups"
124
user_host_groups['bernhard','osuosl-build174-amd64']="$sudo_groups"
125
126

u_shell['mattia']='/bin/zsh'
127
u_shell['lynxis']='/bin/fish'
128
u_shell['jenkins-adm']='/bin/bash'
129

130
131
132
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

133
( $UP2DATE && [ -z "$(find authorized_keys -newer $0)" ] ) || for user in ${users}; do
134
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
135
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
136
137
		continue
	fi
138

139
140
141
142
143
144
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
145
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
146
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
147
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
148
			break
149
		fi
150
151
152
153
154
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
155
	fi
156
157
done

158
159
160
161
162
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

163
164
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
165
166
167
168
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
Holger Levsen's avatar
Holger Levsen committed
169
	profitbricks-build9-amd64)
170
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
171
172
		TMPSIZE=8
		;;
Holger Levsen's avatar
Holger Levsen committed
173
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
174
175
176
		TMPFSSIZE=200
		TMPSIZE=15
		;;
177
178
179
180
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
181
182
183
184
	osuosl*)
		TMPFSSIZE=400
		TMPSIZE=50
		;;
185
186
187
	*) ;;
esac
case $HOSTNAME in
188
189
190
191
192
193
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
194
	jenkins|profitbricks-build*amd64|codethink*|osuosl*)
195
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
196
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
197
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
198
199
200
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
201
202
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
203
				sudo mount /srv/workspace
204
			else
205
				explain "WARNING: mountpoint /srv/workspace is non-empty."
206
207
208
209
210
			fi
		fi
		;;
	*) ;;
esac
211

212
# make sure needed directories exists - some directories will not be needed on all hosts...
213
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
214
215
216
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
Holger Levsen's avatar
Holger Levsen committed
217
	sudo chown jenkins.jenkins $directory
218
done
Holger Levsen's avatar
Holger Levsen committed
219
for directory in /srv/jenkins ; do
220
221
222
223
224
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
225

226
if ! test -h /chroots; then
Holger Levsen's avatar
Holger Levsen committed
227
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
228
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
229
		explain "/chroots could not be cleared."
230
	else
231
		sudo ln -s /srv/workspace/chroots /chroots
232
233
234
	fi
fi

235
236
237
238
239
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
240
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
Holger Levsen's avatar
Holger Levsen committed
241
242
		DEBS=" 
			bash-completion 
243
244
			bc
			bsd-mailx
245
246
			curl
			debian-archive-keyring
247
248
			debootstrap/stretch-backports
			cdebootstrap-
249
250
			devscripts
			eatmydata
251
			etckeeper
252
			figlet
Holger Levsen's avatar
Holger Levsen committed
253
			git
Holger Levsen's avatar
Holger Levsen committed
254
			gnupg
255
			haveged
Holger Levsen's avatar
Holger Levsen committed
256
			htop
257
			less
258
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
259
			lsof
260
261
			molly-guard
			moreutils
262
263
264
			munin-node/stretch-backports
			munin-plugins-core/stretch-backports
			munin-plugins-extra/stretch-backports
Holger Levsen's avatar
Holger Levsen committed
265
			needrestart
266
			netcat-traditional
267
268
			ntp
			ntpdate
269
			pbuilder/stretch-backports
270
			pigz 
271
			postfix
272
			procmail
273
			psmisc
274
			python3-psycopg2 
275
			python3-yaml
Holger Levsen's avatar
Holger Levsen committed
276
			schroot 
277
278
			screen
			slay
279
			stunnel
Holger Levsen's avatar
Holger Levsen committed
280
281
			subversion 
			subversion-tools 
282
			systemd-sysv
Holger Levsen's avatar
Holger Levsen committed
283
284
285
			sudo 
			unzip 
			vim 
286
			zsh
287
			"
288
		case $HOSTNAME in
289
			# needed for rebuilding Debian (using .buildinfo files)
290
			osuosl-build173-amd64) DEBS="$DEBS libdpkg-perl libwww-mechanize-perl sbuild" ;;
291
292
			# needed for opensuse openbuildservice
			osuosl-build174-amd64) DEBS="$DEBS osc obs-build qemu-kvm libjson-perl libxml-simple-perl bsdtar" ;;
293
294
			*) ;;
		esac
295
		# install squid / apache2 on a few nodes only
296
		case $HOSTNAME in
297
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) DEBS="$DEBS
298
				squid" ;;
299
300
			profitbricks-build7-a*) DEBS="$DEBS
				apache2" ;;
301
302
303
304
305
			*) ;;
		esac
		# notifications are only done from a view nodes
		case $HOSTNAME in
			jenkins|jenkins-test-vm|profitbricks-build*) DEBS="$DEBS
306
307
				kgb-client
				python3-yaml" ;;
308
309
			*) ;;
		esac
310
311
312
		# install debootstrap from stretch-backports on ubuntu nodes as since 20180927 debootstrap 1.0.78+nmu1ubuntu1.6 cannot install sid anymore
		case $HOSTNAME in
			codethink*) DEBS="$DEBS
313
				debootstrap/stretch-backports" ;;
314
315
			*) 	;;
		esac
316
317
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
318
			profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
319
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
320
			osuosl-build170-amd64|osuosl-build172-amd64) DEBS="$DEBS ntpdate" ;;
321
322
			*) ;;
		esac
323
		# needed to run coreboot/openwrt/netbsd/fedora jobs
324
		case $HOSTNAME in
325
		osuosl-build171-amd64|osuosl-build172-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
326
				bison
327
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
328
329
330
				cmake
				diffutils
				findutils
331
				fish
Holger Levsen's avatar
Holger Levsen committed
332
333
334
335
336
337
338
339
340
341
342
343
344
				flex
				g++
				gawk
				gcc
				grep
				iasl
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
345
346
				python3-clint
				python3-git
347
				python3-pystache
348
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
349
350
				python3-yaml
				subversion
351
				tree
Holger Levsen's avatar
Holger Levsen committed
352
353
354
				unzip
				util-linux
				zlib1g-dev"
355
356
357
			;;
			*) ;;
		esac
358
359
		# needed to run fdroid jobs
		case $HOSTNAME in
360
			osuosl-build168-amd64) DEBS="$DEBS
361
				androguard/stretch-backports
362
				android-sdk
363
364
				bzr
				git-svn
365
				fdroidserver/stretch-backports
366
				linux-headers-amd64
367
				mercurial
368
				python3-asn1crypto/stretch-backports
369
				python3-babel
370
				python3-mwclient/stretch-backports
371
				python3-setuptools
372
				subversion
373
				vagrant/stretch-backports
374
				virtualbox/stretch-backports"
375
			;;
376
			*) ;;
377
		esac
378
379
380
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
381
382
383
384
385
386
387
			# only needed on the main node
		elif [ "$HOSTNAME" = "jenkins" ] ; then
			DEBS="$DEBS ffmpeg libav-tools python3-popcon dose-extra"
		fi
		# mock is needed to build fedora
		if [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
			DEBS="$DEBS mock"
388
		fi
389
		# only on main node
390
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
391
392
393
394
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
395
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
396
				binfmt-support 
397
398
				bison
				botch
Holger Levsen's avatar
Holger Levsen committed
399
400
401
402
403
404
405
				build-essential 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
406
				flex
Holger Levsen's avatar
Holger Levsen committed
407
				gawk 
408
				ghc
409
				git-lfs
410
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
411
412
413
414
				gocr 
				graphviz 
				iasl 
				imagemagick 
415
416
				ip2host
				jekyll
417
				jenkins-job-builder/stretch-backports
418
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
419
420
421
422
423
424
425
426
427
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libxslt1-dev 
				moreutils 
				mr 
				mtr-tiny 
428
				munin/stretch-backports
Holger Levsen's avatar
Holger Levsen committed
429
				ntp 
430
				obfs4proxy
Holger Levsen's avatar
Holger Levsen committed
431
432
				openbios-ppc 
				openbios-sparc 
433
				openjdk-8-jre 
434
				pandoc
435
				postgresql
436
				postgresql-autodoc
437
				postgresql-client 
Holger Levsen's avatar
Holger Levsen committed
438
439
440
				poxml 
				procmail 
				python3-debian 
441
				python3-pystache
442
				python3-requests
443
				python3-rpy2 
444
445
446
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
447
448
449
450
451
452
453
454
455
456
457
458
459
				python-arpy 
				python-hachoir-metadata 
				python-imaging 
				python-lzma 
				python-pip 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
460
461
				ruby-rspec
				rustc
Holger Levsen's avatar
Holger Levsen committed
462
463
464
465
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
466
467
				syslinux
				systemd/stretch-backports
468
				thin-provisioning-tools
469
				tor
Holger Levsen's avatar
Holger Levsen committed
470
				vncsnapshot 
471
472
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
473
				x11-apps 
474
				xtightvncviewer
475
				xvfb
476
				xvkbd
477
				zutils"
478
479
480
		else
			MASTERDEBS=""
		fi
481
		$UP2DATE || sudo apt-get update
482
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default amd64 kernel on pb-build6+16-i386)
		# - we also use the bpo kernel on osuosl-build172 (but not osuosl-build171)
		# - this is done as a seperate step as bpo kernels are frequently uninstallable when upgraded on bpo
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] \
			|| [ "$HOSTNAME" = "osuosl-build172-amd64" ] ; then
			sudo apt install linux-image-amd64/stretch-backports || true # backport kernels are frequently uninstallable...
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] \
			|| [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
			# we dont vary the kernel on i386 atm, see #875990 + #876035
			sudo apt install linux-image-amd64:amd64
		elif [ "$HOSTNAME" = "osuosl-build169-amd64" ] || [ "$HOSTNAME" = "osuosl-build170-amd64" ] ; then
			# Arch Linux builds latest stuff which sometimes (eg, currentlt Qt) needs newer kernel to build...
			sudo apt install linux-image-amd64/stretch-backports || true # backport kernels are frequently uninstallable...
		fi
Edward Betts's avatar
Edward Betts committed
498
		# don't (re-)install pbuilder if it's on hold
499
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
500
			$UP2DATE || sudo apt-get install pbuilder
501
		fi
502
		# remove unattended-upgrades if it's installed
503
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
504
			 sudo apt-get -y purge unattended-upgrades
505
		fi
506
		sudo apt-get clean
Holger Levsen's avatar
Holger Levsen committed
507
		explain "packages installed."
508
	else
Holger Levsen's avatar
Holger Levsen committed
509
		explain "no new packages to be installed."
510
	fi
511
fi
512

513
#
Holger Levsen's avatar
Holger Levsen committed
514
# deploy package configuration in /etc and /usr
515
#
Holger Levsen's avatar
Holger Levsen committed
516
cd $BASEDIR
517
518
519
520
521
522
523
524
525
for h in common common-amd64 common-i386 common-arm64 common-armhf "$HOSTNAME" ; do
	# $HOSTNAME has precedence over common-$DPKG_ARCH over common
	case $h in
		common-amd64) [ $DPKG_ARCH = "amd64" ] || continue ;;
		common-i386)  [ $DPKG_ARCH = "i386" ] || continue ;;
		common-arm64) [ $DPKG_ARCH = "arm64" ] || continue ;;
		common-armhf) [ $DPKG_ARCH = "armhf" ] || continue ;;
		*) ;;
	esac
526
527
	if [ -d "hosts/$h/etc/sudoers.d/" ]; then
		for f in "hosts/$h/etc/sudoers.d/"* ; do
528
			/usr/sbin/visudo -c -f "$f" > /dev/null
529
530
531
		done
	fi
	for d in etc usr ; do
Mattia Rizzolo's avatar
Mattia Rizzolo committed
532
		if [ -d "hosts/$h/$d" ]; then
533
			sudo cp --preserve=mode,timestamps -r "hosts/$h/$d/"* "/$d"
534
535
536
		fi
	done
done
537
538
# we ship one or two service files…
sudo systemctl daemon-reload &
539
540
541
542
543

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
544
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
Holger Levsen's avatar
Holger Levsen committed
545
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
546

547
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
548
	if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ]  ; then
549
550
551
552
553
554
555
556
557
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
558
559
560
		if [ "$HOSTNAME" = "jenkins" ] ; then
			sudo a2ensite -q jenkins.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
561
			sudo a2enconf -q munin
562
563
564
565
		else # "$HOSTNAME" = "profitbricks-build7-amd64"
			sudo a2ensite -q buildinfos.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/buildinfos.debian.net.conf
		fi
566
567
568
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
569
570
571
	fi
fi

572
if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] ; then
573
	cd /etc/munin/plugins
574
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* df_abs 2>/dev/null
575
	case $HOSTNAME in
576
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
577
578
			*)	;;
	esac
Holger Levsen's avatar
Holger Levsen committed
579
580
581
582
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
583
584
585
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
586
	if ( [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ) && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
587
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
588
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
589
	fi
590
591
	# this is a hack to work around (rare) problems with restarting munin-node...
	sudo service munin-node restart || sudo service munin-node restart || sudo service munin-node restart
592
fi
593
594
595
596
597
598
599
600
601

# add some users to groups after packages have been installed
if ! $UP2DATE ; then
	case $HOSTNAME in
		osuosl-build173-amd64)		sudo adduser jenkins sbuild ;;
		*) 				;;
	esac
fi
# finally
Holger Levsen's avatar
Holger Levsen committed
602
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
603
604
605
606

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
607
cd $BASEDIR
608
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
609
# check for bash syntax *before* actually deploying anything
610
shopt -s nullglob
611
for f in bin/*.sh bin/**/*.sh ; do bash -n "$f" ; done
612
shopt -u nullglob
613
for dir in bin logparse mustache-templates ; do
614
615
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
616
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
617
done
618
619
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
620
	sudo -u jenkins-adm rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
621
else
Philip Hands's avatar
Philip Hands committed
622
623
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
624
625
fi

626

627
sudo mkdir -p -m 700 /var/lib/jenkins/.ssh
628
sudo chown jenkins.jenkins /var/lib/jenkins/.ssh
629
if [ "$HOSTNAME" = "jenkins" ] ; then
630
631
	sudo -u jenkins install -m 600 jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
	sudo -u jenkins cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
632
	sudo -u jenkins cp jenkins-home/offline_nodes /var/lib/jenkins/offline_nodes
633
634
635
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
636
if [ -f jenkins-nodes-home/authorized_keys.$HOSTNAME ] ; then
637
	cat jenkins-nodes-home/authorized_keys.$HOSTNAME | sudo tee -a /var/lib/jenkins/.ssh/authorized_keys
638
fi
639
sudo -u jenkins cp jenkins-home/gitconfig /var/lib/jenkins/.gitconfig
640
641
sudo -u jenkins cp jenkins-home/ssh_config.in /var/lib/jenkins/.ssh/config
nodes/gen_ssh_config | sudo -u jenkins tee -a /var/lib/jenkins/.ssh/config > /dev/null
642
nodes/gen_known_host_file | sudo tee /etc/ssh/ssh_known_hosts > /dev/null
Holger Levsen's avatar
Holger Levsen committed
643
explain "scripts and configurations for jenkins updated."
644

645
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
646
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
647
	TMPFILE=$(mktemp)
648
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
649
	echo "----" >> $TMPFILE
650
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
651
652
	# samuel, lunar, jelle, josch and phil committed with several committers, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" -e "jelle@vdwaa.nl" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
653
	rm $TMPFILE
654
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
655
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
656
657
658
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
659
660
661
662
663
664
665
666
667
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
668
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
669
	explain "user content for jenkins updated."
670
fi
671

672
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
673
674
675
676
677
678
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
Holger Levsen's avatar
Holger Levsen committed
679
680
681
682
683
684
		if [ -f $metaconfig ] ; then
			TMPFILE=$(sudo -u jenkins-adm mktemp)
			./$metaconfig | sudo -u jenkins-adm tee "$TMPFILE" >/dev/null
			if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} "$TMPFILE" ; then
				sudo -u jenkins-adm mv "$TMPFILE" "${metaconfig%.py}"
			fi
685
686
687
		fi
	done
	for config in *.yaml ; do
688
689
690
691
692
693
694
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
695
			echo "$config has changed, executing updates."
696
			$JJB update $config
697
698
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
699
	explain "jenkins jobs updated."
700
fi
701

702
703
704
#
# generate the kgb-client configurations
#
705
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "osuosl-build168-amd64" ] || [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
706
707
708
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
Philip Hands's avatar
Philip Hands committed
709
		# the last condition is to assure the files are owned by the right user/team
710
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
Philip Hands's avatar
Philip Hands committed
711
712
713
714
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
715
	else
Philip Hands's avatar
Philip Hands committed
716
717
718
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
719
720
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
721
	fi
722
	KGB_STATUS="/srv/jenkins/kgb/client-status"
723
724
	sudo mkdir -p $KGB_STATUS
	sudo chown jenkins:jenkins $KGB_STATUS
725
726
fi

727
728
729
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
730
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
731
	: # not generating GPG key as one already exists for jenkins user
732
else
Holger Levsen's avatar
Holger Levsen committed
733
	explain "$(date) - Generating GPG key for jenkins user."
734

735
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
736
737
738
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
739
Name-Real: $HOSTNAME
740
741
742
743
744
745
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
746

747
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
748
749
750
751
752
753

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
754
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
755
	fi
756
757
fi

Holger Levsen's avatar
Holger Levsen committed
758
759
760
761
762
#
# There's always some work left...
#	echo FIXME is ignored so check-jobs scripts can output templates requiring manual work
#
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
763
	TMPFILE=$(mktemp)
764
	rgrep FI[X]ME $BASEDIR/* | grep -v $BASEDIR/TODO | grep -v echo > $TMPFILE || true
Holger Levsen's avatar
Holger Levsen committed
765
766
	if [ -s $TMPFILE ] ; then
		echo
767
		cat $TMPFILE
Holger Levsen's avatar
Holger Levsen committed
768
769
		echo
	fi
770
	rm -f $TMPFILE
Holger Levsen's avatar
Holger Levsen committed
771
772
fi

773
#
774
# almost finally…
775
#
776
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
777
explain "$(date) - finished deployment."
778

779
# finally!
780
case $HOSTNAME in
781
	# set time back to the future
782
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
783
		disable_dsa_check_packages
784
785
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
786
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
787
		disable_dsa_check_packages
788
789
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
790
	osuosl-build170-amd64|osuosl-build172-amd64)
791
792
793
		disable_dsa_check_packages
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
794
	jenkins)
795
		# notify irc on updates of jenkins.d.n
796
797
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
Holger Levsen's avatar
Holger Levsen committed
798
		;;
799
800
	*)	;;
esac
801
802
803
804

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
805
806
echo "__$HOSTNAME=ok__"