178 lines
7.2 KiB
Bash
Executable File
178 lines
7.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
export DOMAIN_NAME="live.fic.srs.epita.fr"
|
|
export IP_FRONTEND="10.42.192.3/24"
|
|
export IP_FRONTEND_ROUTER="10.42.192.1"
|
|
export IP_FIC_SRS_FR=$(host ${DOMAIN_NAME} | grep -o '\([0-9]\{1,3\}.\)\+')
|
|
export IPS_BACKEND="192.168.3.92/24\\n192.168.4.92/24"
|
|
export IP_BACKEND_ROUTER="192.168.3.1"
|
|
|
|
export AIRBUS_BASEURL="https://..."
|
|
export AIRBUS_TOKEN="abcdef0123456789abcdef0123456789"
|
|
export AIRBUS_SESSION_NAME="Forensique"
|
|
|
|
escape_newline () {
|
|
sed 's/$/\\n/g' | tr -d '\n'
|
|
}
|
|
|
|
if [ $# -gt 0 ]
|
|
then
|
|
which jq > /dev/null 2> /dev/null || { echo "Please install jq" >&2; exit 1; }
|
|
|
|
# Expect a previous ISO to update:
|
|
# Keep: DM_CRYPT, DHPARAMs and SYNCHRO_SSH_KEY
|
|
|
|
isoinfo -i "$1" -X -find -iname "USER_DAT*" || 7z x "$1"
|
|
|
|
FNAME="USER_DAT.\;1"
|
|
if ! [ -f "$FNAME" ] && [ -f user-data ]
|
|
then
|
|
FNAME="user-data"
|
|
fi
|
|
|
|
export DM_CRYPT=$(jq -r '."dm-crypt".entries.key.content' "${FNAME}" | escape_newline)
|
|
export DHPARAM=$(jq -r '."tls_config".entries."dhparams-4096.pem".content' "${FNAME}" | escape_newline)
|
|
export SYNCRO_PRIVATE_KEY=$(jq -r '.synchro.entries.id_ed25519.content' "${FNAME}" | escape_newline)
|
|
export SYNCRO_PUBLIC_KEY=$(jq -r '.synchro.entries."id_ed25519.pub".content' "${FNAME}" | escape_newline)
|
|
fi
|
|
|
|
which vault > /dev/null 2> /dev/null || { echo "Please install vault" >&2; exit 1; }
|
|
|
|
export VAULT_ADDR="${VAULT_ADDR:-"https://vault.srs.epita.fr:443"}"
|
|
SSH_PATH="${SSH_PATH:-/tmp/fic_ssh}"
|
|
DHPARAM_PATH="${DHPARAM_PATH:-/tmp/dhparam.pem}"
|
|
OUTPUT_PATH="${OUTPUT_PATH:-"$(mktemp -d)"}"
|
|
|
|
command -v vault &> /dev/null || (echo "vault could not be found" && exit)
|
|
vault login -method=oidc -no-print 2> /dev/null
|
|
|
|
[ -z "${DM_CRYPT}" ] && export DM_CRYPT="$(tr -d -c "a-zA-Z0-9" < /dev/urandom | fold -w512 | head -n 1)"
|
|
export CERT_PEM="$(vault kv get --field=cert.pem fic/cert/fic.srs.epita.fr | escape_newline)"
|
|
export CHAIN_PEM="$(vault kv get --field=chain.pem fic/cert/fic.srs.epita.fr | escape_newline)"
|
|
export FULLCHAIN_PEM="$(vault kv get --field=fullchain.pem fic/cert/fic.srs.epita.fr | escape_newline)"
|
|
export PRIVKEY_PEM="$(vault kv get --field=privkey.pem fic/cert/fic.srs.epita.fr | escape_newline)"
|
|
|
|
if [ -z "${SYNCRO_PUBLIC_KEY}" ] || [ -z "${SYNCRO_PRIVATE_KEY}" ]
|
|
then
|
|
ssh-keygen -a 100 -t ed25519 -q -f "$SSH_PATH" -N "" <<< 'y'
|
|
|
|
export SYNCRO_PUBLIC_KEY="$(cat "$SSH_PATH".pub | escape_newline)"
|
|
export SYNCRO_PRIVATE_KEY="$(cat "$SSH_PATH" | escape_newline)"
|
|
fi
|
|
|
|
if [ -z "${DHPARAM}" ] && ! [ -f "$DHPARAM_PATH" ]
|
|
then
|
|
command -v openssl &> /dev/null || (echo "openssl could not be found" && exit)
|
|
|
|
echo -e "\n\nGenerating DH params please wait"
|
|
openssl dhparam -out "$DHPARAM_PATH" 4096 &>/dev/null
|
|
elif ! [ -f "$DHPARAM_PATH" ]
|
|
then
|
|
echo "${DHPARAM}" > "${DHPARAM_PATH}"
|
|
fi
|
|
export DHPARAM="$(cat "$DHPARAM_PATH" | escape_newline)"
|
|
|
|
TEMPLATE='
|
|
{
|
|
"dm-crypt": {
|
|
"entries": {
|
|
"key": {
|
|
"perm": "0440",
|
|
"content": "${DM_CRYPT}"
|
|
}
|
|
}
|
|
},
|
|
"ssh": {
|
|
"entries": {
|
|
"authorized_keys": {
|
|
"perm": "0444",
|
|
"content": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDCanbPYZGJPlXAbaUkVZPZbGMngjKctmm4dmBOv+eqAkNioeAtUKfmsNWJRZRqB+N2CcIn+0XtgIILNRS1/YC94oAkrSq7lXQ/Pb1vx/N8xQ+c8HCI+YVilKP3digpuVRa8eeCJLnOoBw0MKaXIvul6bG4rUSV+xxXMfeDb0BN9h1CLAnsdK3Ku0DIX57GqtPYbeqTN3tYZ3l+9uewAqUKJ28jEw+DTLUDLytyAw2XDalWMSlnC+WyoXMmwuYz74yKwiRzDPvOloDQf4cEZcdlywcz6HePTcH0d1oPaiTdDtIsI0eSSvZWSLBKA3hc+J3flH2Xyoz4Y7O5pdjoKK7dLoITHGK1Ue9MMCU8n9cqBFozDY7QtJuiY4bx9bdnhUc5PAXGpPR7vWM4tckEcaP8pEhED+h/u7TD4SyZlmUUZVyv7icrcCSQEbIKVLYi8bfMgXxDwkEiAOnTLCEDXT27VauSfQab68RmiMJvylW8ynl7rrM/3T0pbuzRXKJjGnuvNTNMQZqPwt+yp2BtXB/XdLEkh18PI35j/As+hhubxhtYW+esvuDw4a/JBWUtwO7MacM9VlKOtyV+LWKUljVwpgR5mCljauLnL5LulxmjRrcnm2nFCW7WzeSrilEV4AZ2lA0JJLMVI5VAWc6sP+LyM9TA3rmoaMxTxlJkni6Aw== adrien\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK89oym8s0B5LyQbLqTvVKS6U+yPGkHsYATDOfpCCBB8 erwan.poles@epita.fr\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpS5mMfl832EKi03M0awrTbiuGOh+OII5ojM3V9Onl9 tanguy.maraux@gmail.com\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCUKevt/f1n2byv5oH43iQsZ7b4kAATHlHNUF6WMQjk6BSEpdx3Ux1ly0jKy6TPq+04/H0qSC7xF9vGsv3stcbXNST47aIKRnp+27J0SYsj4oaqIGJ/gtgl1QJfJVB+Sld7Sh65zT30kqm0Il3y5PHfpTk/9Y6HOEpnOO8IvmnL4jwiwKMXM+0EyaTaBvsAFo6AYz3/dvkNKSf3SMQWZJNqGtufZcXqg16gWy2+tqALhtCDdmIV1qtK81MxWgol19ZBukk8+qfnX3SgCY1VaJIbBs0vmkixE0e89Pr+mRIPjDL/3U5yH5StUrVOtJqo2pX9mN+r0G8A+lZouprjhu8rGsIyF4zXdcELgh5/ZVR11/OLnZaThsrh1NjZvFdeEgXNZ5IBEZ9KbLUSj7c6lb1j4PtST+BNc8iQj6DdktYluj7LiEgbfpss7rXmoAUC3y01/z1L1GiKJ+FQkN9ri/eQoT3gwyAApS/80MhP4SfgNbdslN49369hY3z04DC7aDc= paul@paul-82wr\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICo5yumHfQbMwhZAtEZByQR0xIVcoealS7g4MNTMEVaX roote@roote-VirtualBox\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDO/3qKhSUbGYZBVraFo68oScJahRDNQfG+uwDQlLv7g nemunaire@khonsou\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDCanbPYZGJPlXAbaUkVZPZbGMngjKctmm4dmBOv+eqAkNioeAtUKfmsNWJRZRqB+N2CcIn+0XtgIILNRS1/YC94oAkrSq7lXQ/Pb1vx/N8xQ+c8HCI+YVilKP3digpuVRa8eeCJLnOoBw0MKaXIvul6bG4rUSV+xxXMfeDb0BN9h1CLAnsdK3Ku0DIX57GqtPYbeqTN3tYZ3l+9uewAqUKJ28jEw+DTLUDLytyAw2XDalWMSlnC+WyoXMmwuYz74yKwiRzDPvOloDQf4cEZcdlywcz6HePTcH0d1oPaiTdDtIsI0eSSvZWSLBKA3hc+J3flH2Xyoz4Y7O5pdjoKK7dLoITHGK1Ue9MMCU8n9cqBFozDY7QtJuiY4bx9bdnhUc5PAXGpPR7vWM4tckEcaP8pEhED+h/u7TD4SyZlmUUZVyv7icrcCSQEbIKVLYi8bfMgXxDwkEiAOnTLCEDXT27VauSfQab68RmiMJvylW8ynl7rrM/3T0pbuzRXKJjGnuvNTNMQZqPwt+yp2BtXB/XdLEkh18PI35j/As+hhubxhtYW+esvuDw4a/JBWUtwO7MacM9VlKOtyV+LWKUljVwpgR5mCljauLnL5LulxmjRrcnm2nFCW7WzeSrilEV4AZ2lA0JJLMVI5VAWc6sP+LyM9TA3rmoaMxTxlJkni6Aw== cardno:18 059 785\n"
|
|
}
|
|
}
|
|
},
|
|
"synchro": {
|
|
"entries": {
|
|
"id_ed25519": {
|
|
"perm": "0400",
|
|
"content": "${SYNCRO_PRIVATE_KEY}"
|
|
},
|
|
"id_ed25519.pub": {
|
|
"perm": "0444",
|
|
"content": "${SYNCRO_PUBLIC_KEY}"
|
|
}
|
|
}
|
|
},
|
|
"ip_config": {
|
|
"entries": {
|
|
"frontend-players": {
|
|
"perm": "0444",
|
|
"content": "${IP_FRONTEND}\\n${IP_FIC_SRS_FR}"
|
|
},
|
|
"frontend-router": {
|
|
"perm": "0444",
|
|
"content": "${IP_FRONTEND_ROUTER}"
|
|
},
|
|
"backend-admin": {
|
|
"perm": "0444",
|
|
"content": "${IPS_BACKEND}"
|
|
},
|
|
"backend-router": {
|
|
"perm": "0444",
|
|
"content": "${IP_BACKEND_ROUTER}"
|
|
},
|
|
"domain": {
|
|
"perm": "0444",
|
|
"content": "${DOMAIN_NAME}"
|
|
}
|
|
}
|
|
},
|
|
"remote_sync": {
|
|
"entries": {
|
|
"baseurl": {
|
|
"perm": "0444",
|
|
"content": "${AIRBUS_BASEURL}"
|
|
},
|
|
"token": {
|
|
"perm": "0444",
|
|
"content": "${AIRBUS_TOKEN}"
|
|
},
|
|
"session_name": {
|
|
"perm": "0444",
|
|
"content": "${AIRBUS_SESSION_NAME}"
|
|
}
|
|
}
|
|
},
|
|
"tls_config": {
|
|
"entries": {
|
|
"dhparams-4096.pem": {
|
|
"perm": "0400",
|
|
"content": "${DHPARAM}"
|
|
},
|
|
"cert.pem": {
|
|
"perm": "0400",
|
|
"content": "${CERT_PEM}"
|
|
},
|
|
"chain.pem": {
|
|
"perm": "0400",
|
|
"content": "${CHAIN_PEM}"
|
|
},
|
|
"fullchain.pem": {
|
|
"perm": "0400",
|
|
"content": "${FULLCHAIN_PEM}"
|
|
},
|
|
"privkey.pem": {
|
|
"perm": "0444",
|
|
"content": "${PRIVKEY_PEM}"
|
|
}
|
|
}
|
|
}
|
|
}'
|
|
|
|
echo "$TEMPLATE" | envsubst > "$OUTPUT_PATH"/user-data
|
|
|
|
echo -e "Result in $OUTPUT_PATH\nGenerating iso"
|
|
|
|
mkisofs -joliet-long -V CIDATA -o fickit-metadata.iso "${OUTPUT_PATH}"
|