update_jdn.sh 26 KB
Newer Older
1
#!/bin/bash
2
# vim: set noexpandtab:
3
# Copyright 2012-2019 Holger Levsen <holger@layer-acht.org>
4
#         ©      2018 Mattia Rizzolo <mattia@debian.org>
5 6
# released under the GPLv=2

7
# puppet / salt / ansible / fai / chef / deployme.app - disclaimer
Holger Levsen's avatar
Holger Levsen committed
8 9 10 11 12 13 14 15 16 17 18
# (IOW: this script has been grown in almost 500 commits and it shows…)
#
# yes, we know… and: "it" should probably still be done.
#
# It just unclear, how/what, and what we have actually mostly works.
#
# Switching to jenkins.debian.org is probably an opportunity
# to write (refactor this into) *yet another deployment script*
# (interacting with the DSA machine setup which is in puppet…),
# thus obsoleting this script gradually, though this is used on
# 47 hosts currently (of which quite some were initially installed
19
# manually…)
Holger Levsen's avatar
Holger Levsen committed
20 21 22
#
# so, yes, patches welcome. saying this is crap alone is not helpful,
# nor is just suggesting some new or old technology. patches most welcome!
23 24
#
# that said, there's a new one: init_node ;)
Holger Levsen's avatar
Holger Levsen committed
25

26 27
set -e

28
BASEDIR="$(dirname "$(readlink -e $0)")"
29
STAMP=/var/log/jenkins/update-jenkins.stamp
30 31
# The $@ below means that command line args get passed on to j-j-b
# which allows one to specify --flush-cache or --ignore-cache
32
JJB="jenkins-jobs $@"
33
DPKG_ARCH="$(dpkg --print-architecture)"
Holger Levsen's avatar
Holger Levsen committed
34

35
# so we can later run some commands only if $0 has been updated…
Philip Hands's avatar
Philip Hands committed
36
if [ -f $STAMP ] && [ $STAMP -nt $BASEDIR/$0 ] ; then
Holger Levsen's avatar
Holger Levsen committed
37
	UP2DATE=true
Holger Levsen's avatar
Holger Levsen committed
38
	echo $HOSTNAME is up2date.
Philip Hands's avatar
Philip Hands committed
39 40
else
	UP2DATE=false
Holger Levsen's avatar
Holger Levsen committed
41
	echo $HOSTNAME needs to be updated.
42 43 44
fi


Holger Levsen's avatar
Holger Levsen committed
45
explain() {
Holger Levsen's avatar
Holger Levsen committed
46
	echo "$HOSTNAME: $1"
Holger Levsen's avatar
Holger Levsen committed
47 48
}

49 50 51
set_correct_date() {
		# set correct date
		sudo service ntp stop || true
52
		sudo ntpdate -b $1
53
}
54

55
disable_dsa_check_packages() {
56
	# disable check for outdated packages as someday in the future
57
	# packages from security.d.o will appear outdated always…
58 59
	echo -e "#!/bin/sh\n# disabled dsa-check by update_jdn.sh\nexit 0" | sudo tee /usr/local/bin/dsa-check-packages
	sudo chmod a+rx /usr/local/bin/dsa-check-packages
60 61
}

62
echo "--------------------------------------------"
Holger Levsen's avatar
Holger Levsen committed
63
explain "$(date) - begin deployment update."
64

65 66 67 68
#
# temporarily test to check which hosts don't use systemd
#
if [ -z "$(dpkg -l|grep systemd-sysv||true)" ] ; then 
69
	echo "no systemd-sysv installed on $(hostname), please enter to continue…"
70 71 72
	read
fi

73
# some nodes need special treatment…
74
case $HOSTNAME in
75
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
Holger Levsen's avatar
Holger Levsen committed
76
		# set correct date
77
		set_correct_date de.pool.ntp.org
78
		;;
79
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
80
		# set correct date
81
		set_correct_date de.pool.ntp.org
Holger Levsen's avatar
Holger Levsen committed
82
		;;
83
	osuosl-build170-amd64|osuosl-build172-amd64)
84
		# set correct date
85
		set_correct_date time.osuosl.org
86
		;;
87 88 89
	*)	;;
esac

90 91 92 93 94 95 96 97 98 99 100
# ubuntu decided to change kernel perms in the middle of LTS…
case $HOSTNAME in
	codethink-sled*)
		# fixup perms
		sudo chmod +r /boot/vmlinuz-*
		;;
	*)	;;
esac



101 102 103
#
# set up users and groups
#
104
declare -A user_host_groups u_shell
105
sudo_groups='jenkins,jenkins-adm,sudo,adm'
106 107 108

# if there's a need for host groups, a case statement on $HOSTNAME here that sets $GROUPNAME, say, should do the trick
# then you can define user_host_groups['phil','lvm_group']=... below
109
# and add checks for the GROUP version where ever the HOSTNAME is checked in the following code
110 111 112 113 114

user_host_groups['helmut','*']="$sudo_groups"
user_host_groups['holger','*']="$sudo_groups"
user_host_groups['holger','jenkins']="reproducible,${user_host_groups['holger','*']}"
user_host_groups['mattia','*']="$sudo_groups"
115
user_host_groups['mattia','jenkins']="reproducible,${user_host_groups['mattia','*']}"
116
user_host_groups['phil','jenkins-test-vm']="$sudo_groups,libvirt,libvirt-qemu"
117
user_host_groups['phil','jenkins']="$sudo_groups"
118
user_host_groups['lunar','jenkins']='reproducible'
119 120
user_host_groups['lynxis','osuosl-build171-amd64']="$sudo_groups"
user_host_groups['lynxis','osuosl-build172-amd64']="$sudo_groups"
121
user_host_groups['lynxis','jenkins']="jenkins"
122
user_host_groups['hans','osuosl-build168-amd64']="$sudo_groups"
123
user_host_groups['vagrant','*']="$sudo_groups"
124
user_host_groups['bernhard','osuosl-build174-amd64']="$sudo_groups"
125 126

u_shell['mattia']='/bin/zsh'
127
u_shell['lynxis']='/bin/fish'
128
u_shell['jenkins-adm']='/bin/bash'
129

130 131 132
# get the users out of the user_host_groups array's index
users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)

133
( $UP2DATE && [ -z "$(find authorized_keys -newer $0)" ] ) || for user in ${users}; do
134
	# -v is a bashism to check for set variables, used here to see if this user is active on this host
135
	if [ ! -v user_host_groups["$user","$HOSTNAME"] ] && [ ! -v user_host_groups["$user",'*'] ] && [ ! -v user_host_groups["$user","$DPKG_ARCH"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
136 137
		continue
	fi
138

139 140 141 142 143 144
	# create the user
	if ! getent passwd $user > /dev/null ; then
		# adduser, defaulting to /bin/bash as shell
		sudo adduser --gecos "" --shell "${u_shell[$user]:-/bin/bash}" --disabled-password $user
	fi
	# add groups: first try the specific host, or if unset fall-back to default '*' setting
145
	for h in "$HOSTNAME" "$DPKG_ARCH" '*' ; do
146
		if [ -v user_host_groups["$user","$h"] ] ; then
Holger Levsen's avatar
Holger Levsen committed
147
			sudo usermod -G "${user_host_groups["$user","$h"]}" $user
148
			break
149
		fi
150 151 152 153 154
	done
	# add the user's keys (if any)
	if ls authorized_keys/${user}@*.pub >/dev/null 2>&1 ; then
		[ -d /var/lib/misc/userkeys ] || sudo mkdir -p /var/lib/misc/userkeys
		cat authorized_keys/${user}@*.pub | sudo tee /var/lib/misc/userkeys/${user} > /dev/null
155
	fi
156 157
done

158 159 160 161 162
sudo mkdir -p /srv/workspace
[ -d /srv/schroots ] || sudo mkdir -p /srv/schroots
[ -h /chroots ] || sudo ln -s /srv/workspace/chroots /chroots
[ -h /schroots ] || sudo ln -s /srv/schroots /schroots

163 164
# prepare tmpfs on some hosts
case $HOSTNAME in
Mattia Rizzolo's avatar
Mattia Rizzolo committed
165 166 167 168
	jenkins)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
169
	profitbricks-build9-amd64)
170
		TMPFSSIZE=40
Mattia Rizzolo's avatar
Mattia Rizzolo committed
171 172
		TMPSIZE=8
		;;
173
	profitbricks-build*)
Mattia Rizzolo's avatar
Mattia Rizzolo committed
174 175 176
		TMPFSSIZE=200
		TMPSIZE=15
		;;
177 178 179 180
	codethink*)
		TMPFSSIZE=100
		TMPSIZE=15
		;;
181 182 183 184
	osuosl*)
		TMPFSSIZE=400
		TMPSIZE=50
		;;
185 186 187
	*) ;;
esac
case $HOSTNAME in
188 189 190 191 192 193
	profitbricks-build*i386)
		if ! grep -q '/srv/workspace' /etc/fstab; then
			echo "Warning: you need to manually create a /srv/workspace partition on i386 nodes, exiting."
			exit 1
		fi
		;;
194
	jenkins|profitbricks-build*amd64|codethink*|osuosl*)
195
		if ! grep -q '^tmpfs\s\+/srv/workspace\s' /etc/fstab; then
196
			echo "tmpfs		/srv/workspace	tmpfs	defaults,size=${TMPFSSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null  
197
		fi
Mattia Rizzolo's avatar
Mattia Rizzolo committed
198 199 200
		if ! grep -q '^tmpfs\s\+/tmp\s' /etc/fstab; then
			echo "tmpfs		/tmp	tmpfs	defaults,size=${TMPSIZE}g	0	0" | sudo tee -a /etc/fstab >/dev/null
		fi
201 202
		if ! mountpoint -q /srv/workspace; then
			if test -z "$(ls -A /srv/workspace)"; then
203
				sudo mount /srv/workspace
204
			else
205
				explain "WARNING: mountpoint /srv/workspace is non-empty."
206 207 208 209 210
			fi
		fi
		;;
	*) ;;
esac
211

212
# make sure needed directories exists - some directories will not be needed on all hosts...
213
for directory in /schroots /srv/reproducible-results /srv/d-i /srv/udebs /var/log/jenkins/ /srv/jenkins /srv/jenkins/pseudo-hosts /srv/workspace/chroots ; do
214 215 216
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
	fi
217
	sudo chown jenkins.jenkins $directory
218
done
Holger Levsen's avatar
Holger Levsen committed
219
for directory in /srv/jenkins ; do
220 221 222 223 224
	if [ ! -d $directory ] ; then
		sudo mkdir $directory
		sudo chown jenkins-adm.jenkins-adm $directory
	fi
done
225

226
if ! test -h /chroots; then
227
	sudo rmdir /chroots || sudo rm -f /chroots # do not recurse
228
	if test -e /chroots; then
Holger Levsen's avatar
Holger Levsen committed
229
		explain "/chroots could not be cleared."
230
	else
231
		sudo ln -s /srv/workspace/chroots /chroots
232 233 234
	fi
fi

235 236 237 238 239
# only on Debian systems
if [ -f /etc/debian_version ] ; then
	#
	# install packages we need
	#
240
	if [ $BASEDIR/$0 -nt $STAMP ] || [ ! -f $STAMP ] ; then
Holger Levsen's avatar
Holger Levsen committed
241 242
		DEBS=" 
			bash-completion 
243 244
			bc
			bsd-mailx
245 246
			curl
			debian-archive-keyring
247
			cdebootstrap-
248 249
			devscripts
			eatmydata
250
			etckeeper
251
			figlet
Holger Levsen's avatar
Holger Levsen committed
252
			git
253
			gnupg
254
			haveged
255
			htop
256
			less
257
			locales-all
Mattia Rizzolo's avatar
Mattia Rizzolo committed
258
			lsof
259 260
			molly-guard
			moreutils
261
			needrestart
262
			netcat-traditional
263 264
			ntp
			ntpdate
265
			pigz 
266
			postfix
267
			procmail
268
			psmisc
269
			python3-psycopg2 
270
			python3-yaml
Holger Levsen's avatar
Holger Levsen committed
271
			schroot 
272 273
			screen
			slay
274
			stunnel
Holger Levsen's avatar
Holger Levsen committed
275 276
			subversion 
			subversion-tools 
277
			systemd-sysv
Holger Levsen's avatar
Holger Levsen committed
278 279 280
			sudo 
			unzip 
			vim 
281
			zsh
282
			"
283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
		case $HOSTNAME in
			# running buster already
			osuosl-build174-amd64) DEBS="$DEBS
				debootstrap
				munin-node
				munin-plugins-core
				munin-plugins-extra
				pbuilder
				" ;;
			*) DEBS="$DEBS
				debootstrap/stretch-backports
				munin-node/stretch-backports
				munin-plugins-core/stretch-backports
				munin-plugins-extra/stretch-backports
				pbuilder/stretch-backports
				" ;;
		esac
300
		case $HOSTNAME in
301
			# needed for rebuilding Debian (using .buildinfo files)
302
			osuosl-build173-amd64) DEBS="$DEBS libdpkg-perl libwww-mechanize-perl sbuild" ;;
303 304
			# needed for opensuse openbuildservice
			osuosl-build174-amd64) DEBS="$DEBS osc obs-build qemu-kvm libjson-perl libxml-simple-perl bsdtar" ;;
305 306
			*) ;;
		esac
307
		# install squid / apache2 on a few nodes only
308
		case $HOSTNAME in
309
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) DEBS="$DEBS
310
				squid" ;;
311 312
			profitbricks-build7-a*) DEBS="$DEBS
				apache2" ;;
313 314 315 316 317
			*) ;;
		esac
		# notifications are only done from a view nodes
		case $HOSTNAME in
			jenkins|jenkins-test-vm|profitbricks-build*) DEBS="$DEBS
318 319
				kgb-client
				python3-yaml" ;;
320 321
			*) ;;
		esac
322 323 324
		# install debootstrap from stretch-backports on ubuntu nodes as since 20180927 debootstrap 1.0.78+nmu1ubuntu1.6 cannot install sid anymore
		case $HOSTNAME in
			codethink*) DEBS="$DEBS
325
				debootstrap/stretch-backports" ;;
326 327
			*) 	;;
		esac
328 329
		# needed to run the 2nd reproducible builds nodes in the future...
		case $HOSTNAME in
330
			profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386) DEBS="$DEBS ntpdate" ;;
331
			codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*) DEBS="$DEBS ntpdate" ;;
332
			osuosl-build170-amd64|osuosl-build172-amd64) DEBS="$DEBS ntpdate" ;;
333 334
			*) ;;
		esac
335
		# needed to run coreboot/openwrt/netbsd/fedora jobs
336
		case $HOSTNAME in
337
		osuosl-build171-amd64|osuosl-build172-amd64) DEBS="$DEBS
Holger Levsen's avatar
Holger Levsen committed
338
				bison
339
				ca-certificates
Holger Levsen's avatar
Holger Levsen committed
340 341 342
				cmake
				diffutils
				findutils
343
				fish
Holger Levsen's avatar
Holger Levsen committed
344 345 346 347 348 349 350 351 352 353 354 355 356
				flex
				g++
				gawk
				gcc
				grep
				iasl
				libc6-dev
				libncurses5-dev
				libssl-dev
				locales-all
				kgb-client
				m4
				make
357 358
				python3-clint
				python3-git
359
				python3-pystache
360
				python3-requests
Holger Levsen's avatar
Holger Levsen committed
361 362
				python3-yaml
				subversion
363
				tree
Holger Levsen's avatar
Holger Levsen committed
364 365 366
				unzip
				util-linux
				zlib1g-dev"
367 368 369
			;;
			*) ;;
		esac
370 371
		# needed to run fdroid jobs
		case $HOSTNAME in
372
			osuosl-build168-amd64) DEBS="$DEBS
373
				androguard/stretch-backports
374
				android-sdk
375 376
				bzr
				git-svn
377
				fdroidserver/stretch-backports
378
				linux-headers-amd64
379
				mercurial
380
				python3-asn1crypto/stretch-backports
381
				python3-babel
382
				python3-mwclient/stretch-backports
383
				python3-setuptools
384
				subversion
385
				vagrant/stretch-backports
386
				virtualbox/stretch-backports"
387
			;;
388
			*) ;;
389
		esac
390 391 392
		if [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
			# for phil only
			DEBS="$DEBS postfix-pcre"
393 394 395 396 397 398 399
			# only needed on the main node
		elif [ "$HOSTNAME" = "jenkins" ] ; then
			DEBS="$DEBS ffmpeg libav-tools python3-popcon dose-extra"
		fi
		# mock is needed to build fedora
		if [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "jenkins" ] ; then
			DEBS="$DEBS mock"
400
		fi
401
		# only on main node
402
		if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
Holger Levsen's avatar
Holger Levsen committed
403 404 405 406
			MASTERDEBS=" 
				apache2 
				apt-file 
				apt-listchanges 
407
				asciidoc
Holger Levsen's avatar
Holger Levsen committed
408
				binfmt-support 
409 410
				bison
				botch
Holger Levsen's avatar
Holger Levsen committed
411 412 413 414 415 416 417
				build-essential 
				cmake 
				cron-apt 
				csvtool 
				dnsmasq-base 
				dstat 
				figlet 
Holger Levsen's avatar
Holger Levsen committed
418
				flex
Holger Levsen's avatar
Holger Levsen committed
419
				gawk 
420
				ghc
421
				git-lfs
422
				git-notifier 
Holger Levsen's avatar
Holger Levsen committed
423 424 425 426
				gocr 
				graphviz 
				iasl 
				imagemagick 
427 428
				ip2host
				jekyll
429
				jenkins-job-builder/stretch-backports
430
				jq
431
				kgb-client
Holger Levsen's avatar
Holger Levsen committed
432 433 434 435 436 437 438 439 440
				libcap2-bin 
				libfile-touch-perl 
				libguestfs-tools 
				libjson-rpc-perl 
				libsoap-lite-perl 
				libxslt1-dev 
				moreutils 
				mr 
				mtr-tiny 
441
				munin/stretch-backports
Holger Levsen's avatar
Holger Levsen committed
442
				ntp 
443
				obfs4proxy
Holger Levsen's avatar
Holger Levsen committed
444 445
				openbios-ppc 
				openbios-sparc 
446
				openjdk-8-jre 
447
				pandoc
448
				postgresql
449
				postgresql-autodoc
450
				postgresql-client 
Holger Levsen's avatar
Holger Levsen committed
451 452 453
				poxml 
				procmail 
				python3-debian 
454
				python3-pystache
455
				python3-requests
456
				python3-rpy2 
457 458 459
				python3-sqlalchemy
				python3-xdg
				python3-yaml
Holger Levsen's avatar
Holger Levsen committed
460 461 462 463 464 465 466 467 468 469 470 471 472
				python-arpy 
				python-hachoir-metadata 
				python-imaging 
				python-lzma 
				python-pip 
				python-setuptools 
				python-twisted 
				python-yaml 
				qemu 
				qemu-kvm 
				qemu-system-x86 
				qemu-user-static 
				radvd 
473 474
				ruby-rspec
				rustc
Holger Levsen's avatar
Holger Levsen committed
475 476 477 478
				seabios 
				shorewall 
				shorewall6 
				sqlite3 
479 480
				syslinux
				systemd/stretch-backports
481
				thin-provisioning-tools
482
				tor
Holger Levsen's avatar
Holger Levsen committed
483
				vncsnapshot 
484 485
				vnstat
				whohas
Holger Levsen's avatar
Holger Levsen committed
486
				x11-apps 
487
				xtightvncviewer
488
				xvfb
489
				xvkbd
490
				zutils"
491 492 493
		else
			MASTERDEBS=""
		fi
494
		$UP2DATE || sudo apt-get update
495
		$UP2DATE || sudo apt-get install $DEBS $MASTERDEBS
496 497 498 499 500 501 502 503 504 505 506 507 508 509 510
		# for varying kernels:
		# - we use bpo kernels on pb-build5+15 (and the default amd64 kernel on pb-build6+16-i386)
		# - we also use the bpo kernel on osuosl-build172 (but not osuosl-build171)
		# - this is done as a seperate step as bpo kernels are frequently uninstallable when upgraded on bpo
		if [ "$HOSTNAME" = "profitbricks-build5-amd64" ] || [ "$HOSTNAME" = "profitbricks-build15-amd64" ] \
			|| [ "$HOSTNAME" = "osuosl-build172-amd64" ] ; then
			sudo apt install linux-image-amd64/stretch-backports || true # backport kernels are frequently uninstallable...
		elif [ "$HOSTNAME" = "profitbricks-build6-i386" ] || [ "$HOSTNAME" = "profitbricks-build16-i386" ] \
			|| [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
			# we dont vary the kernel on i386 atm, see #875990 + #876035
			sudo apt install linux-image-amd64:amd64
		elif [ "$HOSTNAME" = "osuosl-build169-amd64" ] || [ "$HOSTNAME" = "osuosl-build170-amd64" ] ; then
			# Arch Linux builds latest stuff which sometimes (eg, currentlt Qt) needs newer kernel to build...
			sudo apt install linux-image-amd64/stretch-backports || true # backport kernels are frequently uninstallable...
		fi
511
		# don't (re-)install pbuilder if it's on hold
512
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' pbuilder)" != "hi " ] ; then
513
			$UP2DATE || sudo apt-get install pbuilder
514
		fi
515
		# remove unattended-upgrades if it's installed
516
		if [ "$(dpkg-query -W -f='${db:Status-Abbrev}\n' unattended-upgrades 2>/dev/null || true)" = "ii "  ] ; then
517
			 sudo apt-get -y purge unattended-upgrades
518
		fi
519
		sudo apt-get clean
Holger Levsen's avatar
Holger Levsen committed
520
		explain "packages installed."
521
	else
Holger Levsen's avatar
Holger Levsen committed
522
		explain "no new packages to be installed."
523
	fi
524
fi
525

526
#
Holger Levsen's avatar
Holger Levsen committed
527
# deploy package configuration in /etc and /usr
528
#
Holger Levsen's avatar
Holger Levsen committed
529
cd $BASEDIR
530 531 532 533 534 535 536 537 538
for h in common common-amd64 common-i386 common-arm64 common-armhf "$HOSTNAME" ; do
	# $HOSTNAME has precedence over common-$DPKG_ARCH over common
	case $h in
		common-amd64) [ $DPKG_ARCH = "amd64" ] || continue ;;
		common-i386)  [ $DPKG_ARCH = "i386" ] || continue ;;
		common-arm64) [ $DPKG_ARCH = "arm64" ] || continue ;;
		common-armhf) [ $DPKG_ARCH = "armhf" ] || continue ;;
		*) ;;
	esac
539 540
	if [ -d "hosts/$h/etc/sudoers.d/" ]; then
		for f in "hosts/$h/etc/sudoers.d/"* ; do
541
			/usr/sbin/visudo -c -f "$f" > /dev/null
542 543 544
		done
	fi
	for d in etc usr ; do
Mattia Rizzolo's avatar
Mattia Rizzolo committed
545
		if [ -d "hosts/$h/$d" ]; then
546
			sudo cp --preserve=mode,timestamps -r "hosts/$h/$d/"* "/$d"
547 548 549
		fi
	done
done
550 551
# we ship one or two service files…
sudo systemctl daemon-reload &
552 553 554 555 556

#
# more configuration than a simple cp can do
#
sudo chown root.root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenkins
557
sudo chown root.root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
558
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
559

560
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ; then
561
	if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/apache2 -nt $STAMP ]  ; then
562 563 564 565 566 567 568 569 570
		if [ ! -e /etc/apache2/mods-enabled/proxy.load ] ; then
			sudo a2enmod proxy
			sudo a2enmod proxy_http
			sudo a2enmod rewrite
			sudo a2enmod ssl
			sudo a2enmod headers
			sudo a2enmod macro
			sudo a2enmod filter
		fi
571 572 573
		if [ "$HOSTNAME" = "jenkins" ] ; then
			sudo a2ensite -q jenkins.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/jenkins.debian.net.conf
574
			sudo a2enconf -q munin
575 576 577 578
		else # "$HOSTNAME" = "profitbricks-build7-amd64"
			sudo a2ensite -q buildinfos.debian.net
			sudo chown jenkins-adm.jenkins-adm /etc/apache2/sites-enabled/buildinfos.debian.net.conf
		fi
579 580 581
		# for reproducible.d.n url rewriting:
		[ -L /var/www/userContent ] || sudo ln -sf /var/lib/jenkins/userContent /var/www/userContent
		sudo service apache2 reload
582 583 584
	fi
fi

585
if ! $UP2DATE || [ $BASEDIR/hosts/$HOSTNAME/etc/munin -nt $STAMP ] ; then
586
	cd /etc/munin/plugins
587
	sudo rm -f postfix_* open_inodes interrupts irqstats threads proc_pri vmstat if_err_* exim_* netstat fw_forwarded_local fw_packets forks open_files users nfs* iostat_ios ntp* df_abs 2>/dev/null
588
	case $HOSTNAME in
589
			profitbricks-build1-a*|profitbricks-build10*|codethink-sled16*|osuosl-build167*) [ -L /etc/munin/plugins/squid_cache ] || for i in squid_cache squid_objectsize squid_requests squid_traffic ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
590 591
			*)	;;
	esac
592 593 594 595
	case $HOSTNAME in
			jenkins) [ -L /etc/munin/plugins/postfix_mailstats ] || for i in postfix_mailstats postfix_mailvolume postfix_mailqueue ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done ;;
			*)	;;
	esac
596 597 598
	if [ "$HOSTNAME" != "jenkins" ] && [ -L /etc/munin/plugins/iostat ] ; then
		sudo rm /etc/munin/plugins/iostat
	fi
599
	if ( [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "profitbricks-build7-amd64" ] ) && [ ! -L /etc/munin/plugins/apache_accesses ] ; then
600
		for i in apache_accesses apache_volume ; do sudo ln -s /usr/share/munin/plugins/$i $i ; done
601
		sudo ln -s /usr/share/munin/plugins/loggrep jenkins_oom
602
	fi
603 604
	# this is a hack to work around (rare) problems with restarting munin-node...
	sudo service munin-node restart || sudo service munin-node restart || sudo service munin-node restart
605
fi
606 607 608 609

# add some users to groups after packages have been installed
if ! $UP2DATE ; then
	case $HOSTNAME in
610 611 612 613
		osuosl-build170-amd64)
			sudo addgroup --system --gid 300 abuild
			sudo adduser jenkins abuild
			;;
614 615 616 617 618
		osuosl-build173-amd64)		sudo adduser jenkins sbuild ;;
		*) 				;;
	esac
fi
# finally
Holger Levsen's avatar
Holger Levsen committed
619
explain "packages configured."
Holger Levsen's avatar
Holger Levsen committed
620 621 622 623

#
# install the heart of jenkins.debian.net
#
Holger Levsen's avatar
Holger Levsen committed
624
cd $BASEDIR
625
[ -d /srv/jenkins/features ] && sudo rm -rf /srv/jenkins/features
626
# check for bash syntax *before* actually deploying anything
627
shopt -s nullglob
628
for f in bin/*.sh bin/**/*.sh ; do bash -n "$f" ; done
629
shopt -u nullglob
630
for dir in bin logparse mustache-templates ; do
631 632
	sudo mkdir -p /srv/jenkins/$dir
	sudo rsync -rpt --delete $dir/ /srv/jenkins/$dir/
Holger Levsen's avatar
Holger Levsen committed
633
	sudo chown -R jenkins-adm.jenkins-adm /srv/jenkins/$dir
634
done
635 636
HOST_JOBS="hosts/$HOSTNAME/job-cfg"
if [ -e "$HOST_JOBS" ] ; then
637
	sudo -u jenkins-adm rsync -rpt --copy-links --delete "$HOST_JOBS/" /srv/jenkins/job-cfg/
638
else
639 640
	# tidying up ... assuming that we don't want clutter on peripheral servers
	[ -d /srv/jenkins/job-cfg ] && sudo rm -rf /srv/jenkins/job-cfg
641 642
fi

643

644
sudo mkdir -p -m 700 /var/lib/jenkins/.ssh
645
sudo chown jenkins.jenkins /var/lib/jenkins/.ssh
646
if [ "$HOSTNAME" = "jenkins" ] ; then
647 648
	sudo -u jenkins install -m 600 jenkins-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
	sudo -u jenkins cp jenkins-home/procmailrc /var/lib/jenkins/.procmailrc
649
	sudo -u jenkins cp jenkins-home/offline_nodes /var/lib/jenkins/offline_nodes
650 651 652
else
	sudo cp jenkins-nodes-home/authorized_keys /var/lib/jenkins/.ssh/authorized_keys
fi
653
if [ -f jenkins-nodes-home/authorized_keys.$HOSTNAME ] ; then
654
	cat jenkins-nodes-home/authorized_keys.$HOSTNAME | sudo tee -a /var/lib/jenkins/.ssh/authorized_keys
655
fi
656
sudo -u jenkins cp jenkins-home/gitconfig /var/lib/jenkins/.gitconfig
657 658
sudo -u jenkins cp jenkins-home/ssh_config.in /var/lib/jenkins/.ssh/config
nodes/gen_ssh_config | sudo -u jenkins tee -a /var/lib/jenkins/.ssh/config > /dev/null
659
nodes/gen_known_host_file | sudo tee /etc/ssh/ssh_known_hosts > /dev/null
Holger Levsen's avatar
Holger Levsen committed
660
explain "scripts and configurations for jenkins updated."
661

662
if [ "$HOSTNAME" = "jenkins" ] ; then
Holger Levsen's avatar
Holger Levsen committed
663
	sudo cp -pr README INSTALL TODO CONTRIBUTING d-i-preseed-cfgs /var/lib/jenkins/userContent/
664
	TMPFILE=$(mktemp)
665
	git log | grep ^Author| cut -d " " -f2-|sort -u -f > $TMPFILE
666
	echo "----" >> $TMPFILE
667
	sudo tee /var/lib/jenkins/userContent/THANKS > /dev/null < THANKS.head
668 669
	# samuel, lunar, jelle, josch and phil committed with several committers, only display one
	grep -v -e "samuel.thibault@ens-lyon.org" -e Lunar -e "j.schauer@email.de" -e "mattia@mapreri.org" -e "phil@jenkins-test-vm" -e "jelle@vdwaa.nl" $TMPFILE | sudo tee -a /var/lib/jenkins/userContent/THANKS > /dev/null
670
	rm $TMPFILE
671
	TMPDIR=$(mktemp -d -t update-jdn-XXXXXXXX)
672
	sudo cp -pr userContent $TMPDIR/
Holger Levsen's avatar
Holger Levsen committed
673 674 675
	sudo chown -R jenkins.jenkins $TMPDIR
	sudo cp -pr $TMPDIR/userContent  /var/lib/jenkins/
	sudo rm -r $TMPDIR > /dev/null
676 677 678 679 680 681 682 683 684
	cd /var/lib/jenkins/userContent/
	ASCIIDOC_PARAMS="-a numbered -a data-uri -a iconsdir=/etc/asciidoc/images/icons -a scriptsdir=/etc/asciidoc/javascripts -b html5 -a toc -a toclevels=4 -a icons -a stylesheet=$(pwd)/theme/debian-asciidoc.css"
	[ about.html -nt README ] || asciidoc $ASCIIDOC_PARAMS -o about.html README
	[ todo.html -nt TODO ] || asciidoc $ASCIIDOC_PARAMS -o todo.html TODO
	[ setup.html -nt INSTALL ] || asciidoc $ASCIIDOC_PARAMS -o setup.html INSTALL
	[ contributing.html -nt CONTRIBUTING ] || asciidoc $ASCIIDOC_PARAMS -o contributing.html CONTRIBUTING
	diff THANKS .THANKS >/dev/null || asciidoc $ASCIIDOC_PARAMS -o thanks.html THANKS
	mv THANKS .THANKS
	rm TODO README INSTALL CONTRIBUTING
685
	sudo chown jenkins.jenkins /var/lib/jenkins/userContent/*html
Holger Levsen's avatar
Holger Levsen committed
686
	explain "user content for jenkins updated."
687
fi
688

689
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
690 691 692 693 694 695
	#
	# run jenkins-job-builder to update jobs if needed
	#     (using sudo because /etc/jenkins_jobs is root:root 700)
	#
	cd /srv/jenkins/job-cfg
	for metaconfig in *.yaml.py ; do
696 697 698 699 700 701
		if [ -f $metaconfig ] ; then
			TMPFILE=$(sudo -u jenkins-adm mktemp)
			./$metaconfig | sudo -u jenkins-adm tee "$TMPFILE" >/dev/null
			if ! sudo -u jenkins-adm cmp -s ${metaconfig%.py} "$TMPFILE" ; then
				sudo -u jenkins-adm mv "$TMPFILE" "${metaconfig%.py}"
			fi
702 703 704
		fi
	done
	for config in *.yaml ; do
705 706 707 708 709 710 711
		# do update, if
		# no stamp file exist or
		# no .py file exists and config is newer than stamp or
		# a .py file exists and .py file is newer than stamp
		if [ ! -f $STAMP ] || \
		 ( [ ! -f $config.py ] && [ $config -nt $STAMP ] ) || \
		 ( [ -f $config.py ] && [ $config.py -nt $STAMP ] ) ; then
712
			echo "$config has changed, executing updates."
713
			$JJB update $config
714 715
		fi
	done
Holger Levsen's avatar
Holger Levsen committed
716
	explain "jenkins jobs updated."
717
fi
718

719 720 721
#
# generate the kgb-client configurations
#
722
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "osuosl-build168-amd64" ] || [ "$HOSTNAME" = "osuosl-build171-amd64" ] || [ "$HOSTNAME" = "osuosl-build172-amd64" ] || [ "$HOSTNAME" = "profitbricks-build2-i386" ] || [ "$HOSTNAME" = "profitbricks-build12-i386" ] ; then
723 724 725
	cd $BASEDIR
	KGB_SECRETS="/srv/jenkins/kgb/secrets.yml"
	if [ -f "$KGB_SECRETS" ] && [ $(stat -c "%a:%U:%G" "$KGB_SECRETS") = "640:jenkins-adm:jenkins-adm" ] ; then
726
		# the last condition is to assure the files are owned by the right user/team
727
		if [ "$KGB_SECRETS" -nt $STAMP ] || [ "deploy_kgb.py" -nt "$STAMP" ] || [ ! -f $STAMP ] ; then
728 729 730 731
			sudo -u jenkins-adm "./deploy_kgb.py"
		else
			explain "kgb-client configuration unchanged, nothing to do."
		fi
732
	else
733 734 735
		figlet -f banner Warning
		echo "Warning: $KGB_SECRETS either does not exist or has bad permissions. Please fix. KGB configs not generated"
		echo "We expect the secrets file to be mode 640 and owned by jenkins-adm:jenkins-adm."
Holger Levsen's avatar
Holger Levsen committed
736 737
		echo "/srv/jenkins/kgb should be mode 755 and owned by jenkins-adm:root."
		echo "/srv/jenkins/kgb/client-status should be mode 755 and owned by jenkins:jenkins."
738
	fi
739
	KGB_STATUS="/srv/jenkins/kgb/client-status"
740 741
	sudo mkdir -p $KGB_STATUS
	sudo chown jenkins:jenkins $KGB_STATUS
742 743
fi

744 745 746
#
# Create GPG key for jenkins user if they do not already exist (eg. to sign .buildinfo files)
#
747
if sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | cut -d: -f1 | grep -qsFx 'sec' >/dev/null 2>&1 ; then
Holger Levsen's avatar
Holger Levsen committed
748
	: # not generating GPG key as one already exists for jenkins user
749
else
750
	explain "$(date) - Generating GPG key for jenkins user."
751

752
	sudo -H -u jenkins gpg --no-tty --batch --gen-key <<EOF
753 754 755
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
756
Name-Real: $HOSTNAME
757 758 759 760 761 762
Name-Comment: Automatically generated key for signing .buildinfo files
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
EOF
763

764
	GPG_KEY_ID="$(sudo -H -u jenkins gpg --with-colons --fixed-list-mode --list-secret-keys | grep '^sec' | cut -d: -f5 | tail -n1)"
765 766 767 768 769 770

	if [ "$GPG_KEY_ID" = "" ]
	then
		explain "$(date) - Generated GPG key but could not parse key ID"
	else
		explain "$(date) - Generated GPG key $GPG_KEY_ID - submitting to keyserver"
771
		sudo -H -u jenkins gpg --send-keys $GPG_KEY_ID
772
	fi
773 774
fi

775 776 777 778 779
#
# There's always some work left...
#	echo FIXME is ignored so check-jobs scripts can output templates requiring manual work
#
if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "jenkins-test-vm" ] ; then
780
	TMPFILE=$(mktemp)
781
	rgrep FI[X]ME $BASEDIR/* | grep -v $BASEDIR/TODO | grep -v echo > $TMPFILE || true
782 783
	if [ -s $TMPFILE ] ; then
		echo
784
		cat $TMPFILE
785 786
		echo
	fi
787
	rm -f $TMPFILE
788 789
fi

790
#
791
# almost finally…
792
#
793
sudo touch $STAMP	# so on the next run, only configs newer than this file will be updated
Holger Levsen's avatar
Holger Levsen committed
794
explain "$(date) - finished deployment."
795

796
# finally!
797
case $HOSTNAME in
798
	# set time back to the future
799
	profitbricks-build5-amd64|profitbricks-build6-i386|profitbricks-build15-amd64|profitbricks-build16-i386)
800
		disable_dsa_check_packages
801 802
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
803
	codethink-sled9*|codethink-sled11*|codethink-sled13*|codethink-sled15*)
804
		disable_dsa_check_packages
805 806
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
807
	osuosl-build170-amd64|osuosl-build172-amd64)
808 809 810
		disable_dsa_check_packages
		sudo date --set="+398 days +6 hours + 23 minutes"
		;;
811
	jenkins)
812
		# notify irc on updates of jenkins.d.n
813 814
		MESSAGE="jenkins.d.n updated to $(cd $BASEDIR ; git describe --always)."
		kgb-client --conf /srv/jenkins/kgb/debian-qa.conf --relay-msg "$MESSAGE"
815
		;;
816 817
	*)	;;
esac
818 819 820 821

echo
figlet ok
echo
Holger Levsen's avatar
Holger Levsen committed
822 823
echo "__$HOSTNAME=ok__"