From 5a1bf22e0b48cf41f5ab302e51d6d6598c04a3d6 Mon Sep 17 00:00:00 2001 From: Tom Wiesing Date: Mon, 1 Jun 2020 16:46:03 +0200 Subject: [PATCH] Initial commit --- .gitignore | 3 + LICENSE | 674 ++++++++++++++++++++++++++++++++++++++ README.md | 172 ++++++++++ Vagrantfile | 67 ++++ factory/.env.example | 26 ++ factory/lib/00_init.sh | 46 +++ factory/lib/10_config.sh | 128 ++++++++ factory/lib/20_slug.sh | 78 +++++ factory/lib/30_utils.sh | 16 + factory/lib/lib.sh | 20 ++ factory/provision.sh | 193 +++++++++++ factory/remove.sh | 39 +++ factory/shell.sh | 17 + factory/system_install.sh | 111 +++++++ factory/update.sh | 14 + 15 files changed, 1604 insertions(+) create mode 100644 .gitignore create mode 100644 LICENSE create mode 100644 README.md create mode 100644 Vagrantfile create mode 100644 factory/.env.example create mode 100644 factory/lib/00_init.sh create mode 100644 factory/lib/10_config.sh create mode 100644 factory/lib/20_slug.sh create mode 100644 factory/lib/30_utils.sh create mode 100644 factory/lib/lib.sh create mode 100644 factory/provision.sh create mode 100644 factory/remove.sh create mode 100644 factory/shell.sh create mode 100755 factory/system_install.sh create mode 100644 factory/update.sh diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..dfe420c --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.vagrant +.env +*.zip \ No newline at end of file diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..f288702 --- /dev/null +++ b/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/README.md b/README.md new file mode 100644 index 0000000..ec02dc1 --- /dev/null +++ b/README.md @@ -0,0 +1,172 @@ +# Automatic Drupal and WissKi factory scripts + +This repository contains a factory server implementation that creates and maintains a list of Drupal Instances. + +** This is a work in progress and nothing in this repository is ready for production use ** + +## Overview + +This project consists of the following: + +- this README +- several bash scripts in the 'factory' folder that are described below +- a `Vagrantfile` for local testing + +The bash scripts are dependency-free and only assume that a basic debian system is available. +The scripts have been tested only under Debian 10, but may also work under older or newer versions. +All scripts expect to be run as root, and will fail when this is not the case. +Each script is well-commented and all commands are explained. + +Configuration of the bash scripts can be done in the file 'factory/.env'. +A sample configuration file (with documented defaults) is available in 'factory/.env.sample'. +To get started, it is sufficient to run: + +```bash +cd factory/ +cp .env.sample .env +your-favorite-editor .env # open and customize, usually only the domain needs adjusting +``` + +For local testing, it is recommended to use [Vagrant](https://www.vagrantup.com/) and the provided `Vagrantfile`. + +## Preparing the Server -- 'system_install.sh' + +*TLDR: `sudo bash /factory/system_install.sh /path/to/graphdb.zip`* + +To prepare the server for becoming a WissKI factory, a few components need to be installed. +In particular, these are: +- [PHP](https://www.php.net/) and [Composer](https://getcomposer.org/) -- for getting and running the Drupal Code +- serveral PHP modules that are dependencies of Drupal +- [MariaDB](https://mariadb.org/) -- an SQL database +- [Apache2](https://httpd.apache.org/), the corresponding php and [mpm-itk](http://mpm-itk.sesse.net/) modules -- a webserver +- [GraphDB](http://graphdb.ontotext.com/) - an SPARQL backend for WissKi + +With the exception of GraphDB all these components can be installed using Debian's package manager 'apt'. +To install GraphDB, a zip with the binaries needs to be unpacked, and then a systemd service for it needs to be created. + +These steps can be performed automatically. +In particular, after obtaining a license and the installation zip file for 'GraphDB', one can run the 'factory/system_install.sh' script as follows to setup all components: + +```bash +sudo bash /factory/system_install.sh /path/to/graphdb.zip +``` + +In principle this script is idempotent, meaning it can be run multiple times achieving the same effect. + +## Provisioning a new WissKi instance -- 'provision.sh' + +*TLDR: `sudo bash provision.sh slug-of-new-website`* + +A new WissKi instance consists of several components: + +- A [Drupal](https://www.drupal.org/) instance, managed as a [Composer](https://getcomposer.org/) project +- An [Apache](https://httpd.apache.org/) the makes the above available externally +- An [SQL](https://mariadb.org/) database, to store Drupal Nodes in +- A [GraphDB](https://graphdb.ontotext.com/) repository to store RDF triples in + +Each WissKi instance is identified by a ``slug''. +This is a preferably short name that is used to form a domain name for the WissKi instance. +This factory assumes that each instance is a subdomain of a given domain. +For example, if the given domain is 'wisskis.example.com' and the slug of a particular instance is 'blue', the subdomain used by this instance would be 'blue.wisskis.example.com'. +The given domain can be configured within the '.env' file. + +In this implementation we furthermore isolate each WissKi instance from the rest of the system. +For this purpose, we make use of an appropriate system user, an appropriate SQL user and a GraphDB user. +**Note: GraphDB users are not yet implemented ** + +We thus use the following process to provision a new instance: + +__1. We create a new system user and hoem directory__ + +The username is derived from the slug, with a configurable prefix. +The home directory for this user will contain the Drupal PHP files needed to run a WissKi. +For this reason, the home directory for each user is a subdirectory at a standardized location. +By default this is `/var/www/factory/$USER', but this can be customized. + +__2. Create an appropriate SQL database and user__ + +We create a new SQL database to eventually store Drupal-related data in. +The user and database names are again generated from the slug. +The database password is randomly generated and only made available directly to the Drupal instance later. + +__3. Initialize a new composer project__ + +Within the home directory of the dedicated user, we create a new composer project that requires [drupal/recommended-project](https://github.com/drupal/recommended-project)` as well as drush. + +__4. Run the Drupal Installation scripts__ + +We run the Drupal installation scripts. +Here we tell Drupal about the database credentials, and initialize an initial 'admin' user for the drupal instance. +The password for the 'admin' user is randomly generated in this process. + +__5. Create a GraphDB repository__ + +Next, we create a dedidcated GraphDB repository for the WissKi instance. +*TODO*: Create a GraphDB user. + +__6. Add WissKi modules to Drupal__ + +Next, we add the required WissKi modules to Drupal. +*TODO*: Configure the WissKi modules automatically. + +__7. Create a Apache VHost configuration__ + +Finally, we create an apache vhost configuration that makes the drupal website available. +*TODO*: SSL + + +These steps can be performed automatically. +To do so, use: + +```bash +sudo bash /factory/provision.sh SLUG +``` + +## Manually editing WissKi instances -- 'shell.sh' + +Sometimes it is needed to make manual adjustments to an individual instance. +For this purpose, the `shell.sh` script exists. +It opens an interactive shell in the context of a given WissKi instance. +In particular it: +- switches to the appropriate system user +- sets up the '$PATH' environment variable to allow using 'drush' and 'composer' + +To use it, run: + +```bash +sudo bash /factory/shell.sh SLUG +``` + +## Removing an existing WissKi instance -- 'remove.sh' + +* TODO: Document this more * + + +Sometimes it is required to remove a given WissKi instance. +In particular all parts belonging to it should be removed. + + +To use it, run: + +```bash +sudo bash /factory/remove.sh SLUG +``` + + +## TODO + +- More documentation + - Document and improve`update.sh` + - User-level documentation + - What is a factory? + - Why a factory? + - First steps after provisioning +- Writeup approach to SSL (Wildcard cert with proxy that downgrades connections to plain http, or mod_md) +- Automatically setup SALZ adapter (if this is possible) +- Setup users for GraphDB and enable security +- Allow customization of GraphDB paths + + +## License + +Licensed under GPL 3. \ No newline at end of file diff --git a/Vagrantfile b/Vagrantfile new file mode 100644 index 0000000..bbad4df --- /dev/null +++ b/Vagrantfile @@ -0,0 +1,67 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +# All Vagrant configuration is done below. The "2" in Vagrant.configure +# configures the configuration version (we support older styles for +# backwards compatibility). Please don't change it unless you know what +# you're doing. +Vagrant.configure("2") do |config| + # The most common configuration options are documented and commented below. + # For a complete reference, please see the online documentation at + # https://docs.vagrantup.com. + + # Every Vagrant development environment requires a box. You can search for + # boxes at https://vagrantcloud.com/search. + config.vm.box = "debian/buster64" + + # Disable automatic box update checking. If you disable this, then + # boxes will only be checked for updates when the user runs + # `vagrant box outdated`. This is not recommended. + # config.vm.box_check_update = false + + # Create a forwarded port mapping which allows access to a specific port + # within the machine from a port on the host machine. In the example below, + # accessing "localhost:8080" will access port 80 on the guest machine. + # NOTE: This will enable public access to the opened port + # config.vm.network "forwarded_port", guest: 80, host: 8080 + + # Create a forwarded port mapping which allows access to a specific port + # within the machine from a port on the host machine and only allow access + # via 127.0.0.1 to disable public access + config.vm.network "forwarded_port", guest: 80, host: 8080 + + # Create a private network, which allows host-only access to the machine + # using a specific IP. + # config.vm.network "private_network", ip: "192.168.33.10" + + # Create a public network, which generally matched to bridged network. + # Bridged networks make the machine appear as another physical device on + # your network. + # config.vm.network "public_network" + + # Share an additional folder to the guest VM. The first argument is + # the path on the host to the actual folder. The second argument is + # the path on the guest to mount the folder. And the optional third + # argument is a set of non-required options. + config.vm.synced_folder "factory/", "/factory/" + + # Provider-specific configuration so you can fine-tune various + # backing providers for Vagrant. These expose provider-specific options. + # Example for VirtualBox: + # + config.vm.provider "virtualbox" do |vb| + vb.memory = 4096 + vb.cpus = 2 + end + # + # View the documentation for the provider you are using for more + # information on available options. + + # Enable provisioning with a shell script. Additional provisioners such as + # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the + # documentation for more information about their specific syntax and use. + # config.vm.provision "shell", inline: <<-SHELL + # apt-get update + # apt-get install -y apache2 + # SHELL +end diff --git a/factory/.env.example b/factory/.env.example new file mode 100644 index 0000000..a463763 --- /dev/null +++ b/factory/.env.example @@ -0,0 +1,26 @@ +# All WissKi and Drupal Installations are contained within a single directory. +# The name of each subfolder corresponds to the appropriate domain name. +# This variable determines the subfolder to place installations into. +DRUPAL_ROOT=/var/www/factory + +# Each Drupal instance requires a corresponding system user, database users and databases. +# These are also set by the appropriate domain name. +# To differentiate them from other users of the system, these names can be prefixed. +# The prefix to use can be configured here. +# When changing these please consider that no system user may exist that has the same name as a mysql user. +# This is a MariaDB restriction. +SYSTEM_USER_PREFIX=factory- +MYSQL_USER_PREFIX=mysql-factory- +MYSQL_DATABASE_PREFIX=mysql-factory- +GRAPHDB_USER_PREFIX=graphdb-factory- +GRAPHDB_REPO_PREFIX=graphdb-factory- + +# Each created Drupal Instance corresponds to a single domain name. +# These domain names should either be a complete domain name or a sub-domain of a default domain. +# This setting configures the default domain-name to create subdomains of. +DEFAULT_DOMAIN=localhost.kwarc.info + +# Various components use password-based-authentication. +# These passwords are generated automatically. +# This variable can be used to determine their length. +PASSWORD_LENGTH=64 \ No newline at end of file diff --git a/factory/lib/00_init.sh b/factory/lib/00_init.sh new file mode 100644 index 0000000..cd41a5b --- /dev/null +++ b/factory/lib/00_init.sh @@ -0,0 +1,46 @@ +#!/bin/bash +set -e + +# This is a library file. +# It should be 'source'd only, if it is not we bail out here. +if [[ "$0" = "$BASH_SOURCE" ]]; then + echo "This file should not be executed directly, it should be 'source'd only. " + exit 1; +fi + +# Check that we are running on a linux system, to prevent accidentally running on Windows or Mac. +# Ideally we would want to explicitly limit to Debian / Ubuntu but at this point that's not needed. +OS="$(uname -s)" +case "${OS}" in + Linux*) :;; + *) echo "This script must be run under Linux. "; exit 1;; +esac + +# To prevent accidentally messing up permissions, we need to always run as root. +# Check that the uid is 0, and otherwise bail out. +if [[ $EUID -ne 0 ]]; then + echo "This script should be run as root, use 'sudo' if in doubt. " + exit 1; +fi + +# We enable shell aliases, to allow us to setup utility functions much more easily. +# To be safe that we don't have any other ones in the environment, we first unalias everything. +unalias -a +shopt -s expand_aliases + +# Setup some basic input/output functions +function log_info() { + echo -e "\033[1m$1\033[0m" +} + +function log_ok() { + echo -e "\033[0;32m$1\033[0m" +} + +function log_warn() { + echo -e "\033[1;33m$1\033[0m" +} + +function log_error() { + echo -e "\033[0;31m$1\033[0m" +} \ No newline at end of file diff --git a/factory/lib/10_config.sh b/factory/lib/10_config.sh new file mode 100644 index 0000000..49acaab --- /dev/null +++ b/factory/lib/10_config.sh @@ -0,0 +1,128 @@ +#!/bin/bash +set -e + +# This is a library file. +# It should be 'source'd only, if it is not we bail out here. +if [[ "$0" = "$BASH_SOURCE" ]]; then + echo "This file should not be executed directly, it should be 'source'd only. " + exit 1; +fi + +# The Path to the configuration file. +CONFIG_FILE="$SCRIPT_DIR/.env" + +# Check that the configuration file exists. +# If it does not, throw an error +log_info " => Reading configuration file" +if ! [ -f "$CONFIG_FILE" ]; then + log_error "" + log_error "Missing configuration, provide a '.env' file" + exit 1 +fi + +# 'source' in the configuration file. +# Ideally we would want to make sure to prevent code-executation within the .env file +# But for the moment let's not. +source "$CONFIG_FILE" + +# Next, validate all the configuration settings. + +# is_valid_slug checks if it's argument is a valid 'slug'. +# A slug is any non-empty string of alphanumeric characters or '-'s. +# The first character of a slug may not be a dash. +function is_valid_slug() { + if [[ "$1" =~ ^[a-zA-Z0-9][-a-zA-Z0-9]*$ ]]; then + return 0; + else + return 1; + fi; +} + +# is_valid_abspath checks if it's argument is an absolute path. +function is_valid_abspath() { + if [[ "$1" =~ ^\/(.+)\/([^/]+)$ ]]; then + return 0; + else + return 1; + fi; +} + +# 'is_valid_domain' checks if a number is a valid domain. +# A domain consists of at least one slug, seperated by '.'s. +# Each token is a slug. +function is_valid_domain() { + if [[ "$1" =~ ^([a-zA-Z0-9][-a-zA-Z0-9]*\.)*[a-zA-Z0-9][-a-zA-Z0-9]*$ ]]; then + return 0; + else + return 1; + fi; +} + +# 'is_valid_number' checks if a value is a valid number. +function is_valid_number() { + if [[ "$1" =~ ^[1-9][0-9]*$ ]]; then + return 0; + else + return 1; + fi; +} + +# The 'DRUPAL_ROOT' variable must be an absolute path. +if ! is_valid_abspath "$DRUPAL_ROOT"; then + log_error "Variable 'DRUPAL_ROOT' is missing or not a valid path. "; + log_info "Please verify that it is set correctly in '.env'. "; + log_info "Please ensure that it does not end in '/'. "; + exit 1; +fi + +# The 'SYSTEM_USER_PREFIX' variable must be a valid slug. +if ! is_valid_slug "$SYSTEM_USER_PREFIX"; then + log_error "Variable 'SYSTEM_USER_PREFIX' is missing or not a valid slug. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +# The 'MYSQL_USER_PREFIX' variable must be a valid slug. +if ! is_valid_slug "$MYSQL_USER_PREFIX"; then + log_error "Variable 'MYSQL_USER_PREFIX' is missing or not a valid slug. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +# The 'MYSQL_DATABASE_PREFIX' variable must be a valid slug. +if ! is_valid_slug "$MYSQL_DATABASE_PREFIX"; then + log_error "Variable 'MYSQL_DATABASE_PREFIX' is missing or not a valid slug. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +# The 'GRAPHDB_USER_PREFIX' variable must be a valid slug. +if ! is_valid_slug "$GRAPHDB_USER_PREFIX"; then + log_error "Variable 'DATABASE_PREFIX' is missing or not a valid slug. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +# The 'GRAPHDB_REPO_PREFIX' variable must be a valid slug. +if ! is_valid_slug "$GRAPHDB_REPO_PREFIX"; then + log_error "Variable 'GRAPHDB_REPO_PREFIX' is missing or not a valid slug. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + + +# The 'DOMAIN' variable must be a valid domain. +if ! is_valid_domain "$DEFAULT_DOMAIN"; then + log_error "Variable 'DEFAULT_DOMAIN' is missing or not a valid domain. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +# The 'PASSWORD_LENGTH' variable must be a valid number. +if ! is_valid_number "$PASSWORD_LENGTH"; then + log_error "Variable 'PASSWORD_LENGTH' is missing or not a valid number. "; + log_info "Please verify that it is set correctly in '.env'. "; + exit 1; +fi + +log_ok "Read and validated configuration file. " \ No newline at end of file diff --git a/factory/lib/20_slug.sh b/factory/lib/20_slug.sh new file mode 100644 index 0000000..9c60967 --- /dev/null +++ b/factory/lib/20_slug.sh @@ -0,0 +1,78 @@ +#!/bin/bash +set -e + +# This is a library file. +# It should be 'source'd only, if it is not we bail out here. +if [[ "$0" = "$BASH_SOURCE" ]]; then + echo "This file should not be executed directly, it should be 'source'd only. " + exit 1; +fi + +# This file reads a single slug command line option. +# This is validated when 'require_slug_argument' is called. + +function require_slug_argument() { + # The 'SLUG' argument must be a valid slug. + if ! is_valid_slug "$SLUG"; then + log_error "Argument 'SLUG' is missing or not a valid slug. "; + log_info "Please provide it via the command line. "; + exit 1; + fi + + log_info " => Deriving configuration for '$SLUG'. " + echo "Domain Name: $INSTANCE_DOMAIN" + echo "Base Directory: $BASE_DIR" + echo "System User: $SYSTEM_USER" + echo "MySQL User: $MYSQL_USER" + echo "MySQL Database: $MYSQL_DATABASE" + echo "GraphDB User: $GRAPHDB_USER" + echo "GraphDB Repository: $GRAPHDB_REPO" +} + +# Read the slug argument. +# We also read it in for scripts where it is not required, and will only use it if that is the case. +SLUG="$1" + +# Compute the domain name for this instance. +# Also lowercase the domain name for consistency. +INSTANCE_DOMAIN="$SLUG.$DEFAULT_DOMAIN" +INSTANCE_DOMAIN="$(echo "$INSTANCE_DOMAIN" | tr '[:upper:]' '[:lower:]')" + +# Next we need a username base. +# This will be used as a username across the system (linux), MySQL and GraphDB. +# For this we can only allow [0-9a-zA-Z-], hence we have to escape. +# In most cases, the only characters that require escaping are '.'s. +# Hence we replace '.' with '-'s. +# We replace the other two characters that require escaping (_ and -)s with --u and --s respectively. +# Because no two dots can ever follow each other in the INSTANCE_DOMAIN, this is guaranteed collision free. +# We also have to do the '-' replacement first, to prevent escaped other characters from being escaped twice. +USERNAME_BASE="$SLUG" +USERNAME_BASE="${USERNAME_BASE//-/--d}" +USERNAME_BASE="${USERNAME_BASE//_/--u}" +USERNAME_BASE="${USERNAME_BASE//./-}" + +# Generate the user and database names for the various systems +SYSTEM_USER="${SYSTEM_USER_PREFIX}${USERNAME_BASE}" +MYSQL_USER="${MYSQL_USER_PREFIX}${USERNAME_BASE}" +MYSQL_DATABASE="${MYSQL_DATABASE_PREFIX}${USERNAME_BASE}" +GRAPHDB_USER="${GRAPHDB_USER_PREFIX}${USERNAME_BASE}" +GRAPHDB_REPO="${GRAPHDB_REPO_PREFIX}${USERNAME_BASE}" + +# Compute the base directory for the files that will live on disk. +BASE_DIR="$DRUPAL_ROOT/$INSTANCE_DOMAIN" +COMPOSER_DIR="$BASE_DIR/project" +WEB_DIR="$COMPOSER_DIR/web" + +# Setup aliases for drush and composer. +alias composer="sudo -u $SYSTEM_USER /usr/local/bin/composer" +alias drush="sudo -u $SYSTEM_USER $COMPOSER_DIR/vendor/bin/drush" + +# Because of a bug in Drupal we constantly have to reset the permissions of the site directory. +# See https://www.drupal.org/project/drupal/issues/3091285. +function drupal_sites_permission_workaround() { + chmod -R u+w "$WEB_DIR/sites/" +} + +# Apache configuration paths +APACHE_CONFIG_SITE_AVAILABLE="/etc/apache2/sites-available/${INSTANCE_DOMAIN}.conf" +APACHE_CONFIG_SITE_ENABLED="/etc/apache2/sites-enabled/${INSTANCE_DOMAIN}.conf" \ No newline at end of file diff --git a/factory/lib/30_utils.sh b/factory/lib/30_utils.sh new file mode 100644 index 0000000..40793af --- /dev/null +++ b/factory/lib/30_utils.sh @@ -0,0 +1,16 @@ +#!/bin/bash +set -e + +# This is a library file. +# It should be 'source'd only, if it is not we bail out here. +if [[ "$0" = "$BASH_SOURCE" ]]; then + echo "This file should not be executed directly, it should be 'source'd only. " + exit 1; +fi + +# Set a few variables to point to the debian frontend +export DEBIAN_FRONTEND=noninteractive + +# This file just sets a few utility functions to be used by the code. +# randompw generates a random password as per the configuration file. +alias randompw="cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $PASSWORD_LENGTH | head -n 1" \ No newline at end of file diff --git a/factory/lib/lib.sh b/factory/lib/lib.sh new file mode 100644 index 0000000..d0f1612 --- /dev/null +++ b/factory/lib/lib.sh @@ -0,0 +1,20 @@ +#!/bin/bash +set -e + +# This file will load all the library functions needed by the various scripts. +# It should be 'source'd only, if it is not we bail out here. +if [[ "$0" = "$BASH_SOURCE" ]]; then + echo "This file should not be executed directly, it should be 'source'd only. " + exit 1; +fi + +# Set variables for the script_dir and the lib_dir +SCRIPT_DIR="$(pwd)" +LIB_DIR="$SCRIPT_DIR/lib" + +# Next, we load a bunch of utility functions stored in lib/lib__.sh +# These contain functionality used in the various scripts. +source "$LIB_DIR/00_init.sh"; +source "$LIB_DIR/10_config.sh"; +source "$LIB_DIR/20_slug.sh"; +source "$LIB_DIR/30_utils.sh"; diff --git a/factory/provision.sh b/factory/provision.sh new file mode 100644 index 0000000..e749d90 --- /dev/null +++ b/factory/provision.sh @@ -0,0 +1,193 @@ +#!/bin/bash + +# This script will provision a new Drupal instance and make it available to apache. +# Usage: sudo ./provision.sh $SLUG +# In case the installation fails, it will bail out and leave you with an incomplete installation. +# To delete an incomplete installation, use the ./remove.sh script, or try fixing the error manually. +set -e + +# read the lib/shared.sh and read the slug argument. +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd "$DIR" +source "$DIR/lib/lib.sh" +require_slug_argument + + +# Check that the apache2 config is correct. +# This is a sanity test so that we don't randomly fail later because of bad config. +log_info " => Checking apache configuration" +apache2ctl configtest > /dev/null + +# Create a system user and group +log_info " => Creating system user and group '$SYSTEM_USER'" +addgroup --system "$SYSTEM_USER" +adduser --home "$BASE_DIR" --system --disabled-password --disabled-login --ingroup "$SYSTEM_USER" "$SYSTEM_USER" + +# Make directory for the composer project to live in +log_info " => Making composer directory '$COMPOSER_DIR'" +sudo -u "$SYSTEM_USER" mkdir -p "$COMPOSER_DIR" +cd "$COMPOSER_DIR" + +# Write out a new apache configuration file into /etc/apache2/sites-available. +# We will need to substiute in some configuration directories. +log_info " => Writing new apache configuration file" +cat << EOF >> "$APACHE_CONFIG_SITE_AVAILABLE" + + DocumentRoot $WEB_DIR + ServerName $INSTANCE_DOMAIN + AssignUserId $SYSTEM_USER $SYSTEM_USER + + + Options Indexes FollowSymLinks + AllowOverride All + Require all granted + + ErrorLog \${APACHE_LOG_DIR}/error.log + CustomLog \${APACHE_LOG_DIR}/access.log combined + +EOF + +# Create a new composer project. +log_info " => Creating composer project" +composer create-project drupal/recommended-project . +composer require drush/drush + +# Randomly generate the database name and user we will configure. +# Use the 'randompw' alias for this. +log_info " => Generating new MySQL password" +MYSQL_PASSWORD="$(randompw)" + +# Initialize the SQL database with those credentials. +log_info " => Intializing new SQL database '${MYSQL_DATABASE}' and user '$MYSQL_USER'. " +mysql -e "CREATE DATABASE \`${MYSQL_DATABASE}\`;" +mysql -e "CREATE USER \`${MYSQL_USER}\`@localhost IDENTIFIED BY '${MYSQL_PASSWORD}';" +mysql -e "GRANT ALL PRIVILEGES ON \`${MYSQL_DATABASE}\`.* TO \`${MYSQL_USER}\`@localhost;" +mysql -e "FLUSH PRIVILEGES;" + +# Generate some more random credentials, this time for drupal. +# We again make use of the randompw alias. +log_info " => Generating new drupal credentials" +DRUPAL_USER="admin" +DRUPAL_PASS="$(randompw)" + +# Use 'drush' to run the site-installation. +# Here we need to use the username, password and database creds we made above. +log_info " => Running drupal installation scripts" +drush site-install standard --yes --site-name=${INSTANCE_DOMAIN} --account-name=$DRUPAL_USER --account-pass=$DRUPAL_PASS --db-url=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@localhost/${MYSQL_DATABASE} +drupal_sites_permission_workaround + +# Create a new repository for GraphDB. +# First write out the configuration into a new directory. +log_info " => Writing GraphDB configuration in temporary directory" +tmpdir="$(mktemp -d)" +cd "$tmpdir" +cat << EOF > repo-config.ttl +# Creates a new GraphDB repository with Wisski + +@prefix rdfs: . +@prefix rep: . +@prefix sr: . +@prefix sail: . +@prefix owlim: . + +[] a rep:Repository ; + rep:repositoryID "$GRAPHDB_REPO" ; + rdfs:label "$INSTANCE_DOMAIN" ; + rep:repositoryImpl [ + rep:repositoryType "graphdb:FreeSailRepository" ; + sr:sailImpl [ + sail:sailType "graphdb:FreeSail" ; + + owlim:owlim-license "" ; + + owlim:base-URL "http://$INSTANCE_DOMAIN#" ; + owlim:defaultNS "" ; + owlim:entity-index-size "10000000" ; + owlim:entity-id-size "32" ; + owlim:imports "" ; + owlim:repository-type "file-repository" ; + owlim:ruleset "empty" ; + owlim:storage-folder "storage" ; + + owlim:enable-context-index "false" ; + owlim:cache-memory "80m" ; + owlim:tuple-index-memory "80m" ; + + owlim:enablePredicateList "false" ; + owlim:predicate-memory "0%" ; + + owlim:fts-memory "0%" ; + owlim:ftsIndexPolicy "never" ; + owlim:ftsLiteralsOnly "true" ; + + owlim:in-memory-literal-properties "false" ; + owlim:enable-literal-index "true" ; + owlim:index-compression-ratio "-1" ; + + owlim:check-for-inconsistencies "false" ; + owlim:disable-sameAs "false" ; + owlim:enable-optimization "true" ; + owlim:transaction-mode "safe" ; + owlim:transaction-isolation "true" ; + owlim:query-timeout "0" ; + owlim:query-limit-results "0" ; + owlim:throw-QueryEvaluationException-on-timeout "false" ; + owlim:useShutdownHooks "true" ; + owlim:read-only "false" ; + owlim:nonInterpretablePredicates "http://www.w3.org/2000/01/rdf-schema#label;http://www.w3.org/1999/02/22-rdf-syntax-ns#type;http://www.ontotext.com/owlim/ces#gazetteerConfig;http://www.ontotext.com/owlim/ces#metadataConfig" ; + ] + ]. +EOF + +# Create the configuration and use the configuration generated above. +# TODO: Permissions for GraphdDB +log_info "Generating new GraphDB repository '$GRAPHDB_REPO'" +curl -X POST\ + http://127.0.0.1:7200/rest/repositories\ + -H 'Content-Type: multipart/form-data'\ + -F "config=@repo-config.ttl" + +# Remove the temporary directory. +cd .. +rm -rf "$tmpdir" + +# Install the Wisski packages. +log_info " => Installing Wisski packages" +cd "$COMPOSER_DIR" + +drupal_sites_permission_workaround +composer require drupal/wisski + +drupal_sites_permission_workaround +composer require drupal/inline_entity_form + +drupal_sites_permission_workaround +composer require drupal/imagemagick + +drupal_sites_permission_workaround +composer require drupal/image_effects + +drupal_sites_permission_workaround +composer require drupal/colorbox + + +# Enable the WissKi modules. +log_info " => Enable Wisski modules" +drush pm-enable --yes wisski_core wisski_linkblock wisski_pathbuilder wisski_adapter_sparql11_pb wisski_salz +drupal_sites_permission_workaround + +# TODO: Setup WissKi-Salz. + +# Finally enable the apache2 config. +# And then reload to start serving it. +log_info " => Enabling and reloading apache configuration" +a2ensite "${INSTANCE_DOMAIN}" +systemctl reload apache2 + +# TODO: Certbot support + +# and done! +log_info " => Finished" +log_info " => Your Drupal Instance is available at http://$INSTANCE_DOMAIN" +log_info " => Your Drupal username is '$DRUPAL_USER', your password is '$DRUPAL_PASS'. " + diff --git a/factory/remove.sh b/factory/remove.sh new file mode 100644 index 0000000..aa1775d --- /dev/null +++ b/factory/remove.sh @@ -0,0 +1,39 @@ +#!/bin/bash +set -e + +# TODO: Delete system user + +# read the lib/shared.sh and read the slug argument. +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd "$DIR" +source "$DIR/lib/lib.sh" +require_slug_argument + +# Delete the apache configurationf files first. +# This prevents drupal from being served. +log_info " => Removing apache configuration files" +rm "$APACHE_CONFIG_SITE_ENABLED" || true +rm "$APACHE_CONFIG_SITE_AVAILABLE" || true + +# Reload apache to apply the configuration. +log_info " => Reloading apache" +systemctl reload apache2 + +# Delete the MySQL database next. +log_info " => Deleting MySQL database '$MYSQL_DATABASE' and user '$MYSQL_USER'. " +mysql -e "DROP DATABASE IF EXISTS \`${MYSQL_DATABASE}\`;" || true +mysql -e "DROP USER IF EXISTS \`${DBNAME}\`@localhost;" || true + +# Clear the GraphDB repository. +log_info " => Deleting GraphDB repository '$GRAPHDB_REPO'" +curl -X DELETE http://127.0.0.1:7200/rest/repositories/$GRAPHDB_REPO/ + +log_info " => Deleting system user and group '$SYSTEM_USER'" +deluser "$SYSTEM_USER" || true +delgroup "$SYSTEM_USER" || true + +# Finally remove any trace of the repository by removing the base directory. +log_info " => Removing directory '$BASE_DIR'" +rm -rf "$BASE_DIR" + +log_info " => Finished, '$INSTANCE_DOMAIN' has been removed. " \ No newline at end of file diff --git a/factory/shell.sh b/factory/shell.sh new file mode 100644 index 0000000..d344173 --- /dev/null +++ b/factory/shell.sh @@ -0,0 +1,17 @@ +#!/bin/bash +set -e + +# read the lib/shared.sh and lib/slug.sh +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd "$DIR" +source "$DIR/lib/lib.sh" +require_slug_argument + +log_info " => Opening shell in '$COMPOSER_DIR'" + +# cd into the right directory. +cd "$COMPOSER_DIR" + +# add /usr/local/bin (for composer) and the vendor bin (for drush) to path +# and open a bash shell as www-data there. +sudo -u "$SYSTEM_USER" PATH="$COMPOSER_DIR/vendor/bin:/usr/local/bin:$PATH" /bin/bash \ No newline at end of file diff --git a/factory/system_install.sh b/factory/system_install.sh new file mode 100755 index 0000000..670d679 --- /dev/null +++ b/factory/system_install.sh @@ -0,0 +1,111 @@ +#!/bin/bash +set -e + +# read the lib/shared.sh +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd "$DIR" +source "$DIR/lib/lib.sh" + +# This script will prepare a server to become a factory for Drupal Instances. +# Even though it assumes a clean server, it *should* be idempotent. +log_info "=> Preparing system to serve as a factory. " + +# Read the 'GRAPHDB_ZIP' argument from the command line. +# If it's not set, throw an error. +GRAPHDB_ZIP=$1 +if [ -z "$GRAPHDB_ZIP" ]; then + log_error "Usage: system_install.sh GRAPHDB_ZIP" + exit 1; +fi; + +# Make a temporary directory to use for various tasks during this script. +log_info " => Making temporary directory" +tmpdir="$(mktemp -d)" +log_ok "Made $tmpdir" + +# fetch new package versions, then upgrade everything we already have. +# This isn't technically neccessary, but it means it'll work on an otherwise untouched system. +log_info " => Installing package updates ..." +apt-get update +apt-get dist-upgrade -y + +# Install composer, by downloading it using curl and then run it with php to install it in /usr/local/bin. +log_info " => Installing composer" +apt-get install -y curl php-cli php-mbstring git unzip +curl -sS https://getcomposer.org/installer -o "$tmpdir/composer-setup.php" +php $tmpdir/composer-setup.php --install-dir=/usr/local/bin --filename=composer + +# Install required php extensions for Drupal and WissKi. +log_info " => Installing required php extensions" +apt-get install -y php-xml php-gd php-mysql php-common php-xmlrpc php-soap php-gd php-intl php-mysql php-zip php-curl php-ssh2 + +# Install the mariadb kernel. +log_info " => Installing mariadb" +apt-get -y install mariadb-server + +# Install apache and required php extensions. +log_info " => Installing apache2, php and auth modules" +apt-get install -y apache2 libapache2-mod-php libapache2-mpm-itk + +# Make the directory for all drupal instances to live in. +log_info " => Making root directory for Drupal Installations" +mkdir -p "$DRUPAL_ROOT" + +# Install java for GraphDB. +# We use the 'headless' package to prevent installing anything graphical on a headless server. +log_info " => Installing java" +apt-get install -y default-jre-headless + + +# Next we have to check if we need to install graphdb. +# If '/opt/graphdb' exists, assume that the installation has already been performed. +if [ -d "/opt/graphdb" ]; then + log_info " => 'opt/graphdb' exists, skipping setup step. "; +else + + # Unzip the GraphDB sources into a temporary directory. + echo " => Unzipping GraphDB into temporary directory" + unzip "$GRAPHDB_ZIP" -d "$tmpdir/graphdb" + + # Then move them into /opt/graphdb. + # Here we need to make sure that the first subdirectoy is renamed appropriately during the move. + echo " => Moving GraphDB into /opt/graphdb" + mv "$tmpdir/graphdb"/* /opt/graphdb +fi + +# Next make a system group 'graphdb' and system user 'graphdb'. +# And also chown the /opt/graphdb directory to that user. +# As the user might already exist, we surpress errors of the commands. +log_info " => Making GraphDB group and user" +addgroup --system graphdb || true +adduser --home "/opt/graphdb" --system --no-create-home --disabled-password --disabled-login --ingroup graphdb graphdb || true +chown -R graphdb:graphdb /opt/graphdb + +# Create a service file to use graphdb with systemd. +# This file uses the users created above, and also hard-codes listening address and maximum memory. +# This avoids having to write the config file using bash hacks. +log_info " => Making 'graphdb.service'" +cat << "EOF" > /etc/systemd/system/graphdb.service +[Unit] +Description=GraphDB + +[Service] +Type=simple +User=graphdb +Group=graphdb +ExecStart=/opt/graphdb/bin/graphdb –Xmx6g -Dgraphdb.connector.address=127.0.0.1 + +[Install] +WantedBy=multi-user.target +EOF + +# We just created a service, so now start it and put it into autostart mode. +log_info " => Starting and enabling graphdb.service" +systemctl enable graphdb +systemctl start graphdb + +# Finally remove the temporary directory we created above. +log_info " => Removing temporary directory" +rm -rf "$tmpdir" + +log_info " => Server is now ready to become a factory. " \ No newline at end of file diff --git a/factory/update.sh b/factory/update.sh new file mode 100644 index 0000000..6096afb --- /dev/null +++ b/factory/update.sh @@ -0,0 +1,14 @@ +#!/bin/bash +set -e + +# read the lib/shared.sh and lib/slug.sh +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd "$DIR" +source "$DIR/lib/lib.sh" +require_slug_argument + +# TODO: Figure out if this is enough. +echo " => Running 'composer update'" +cd "$COMPOSER_DIR" +drupal_sites_permission_workaround +composer update \ No newline at end of file