refactor(provisioning): make scripts self-locating and read configs locally
All provisioning scripts and modules now resolve their own location via
BASH_SOURCE and derive PROJECT_ROOT_PATH from it, removing a hard
dependency on the current working directory.
- Derive PROJECT_ROOT_PATH/CONFIGFILES_PATH/MODULES_PATH/SCRIPTS_PATH
from BASH_SOURCE in SetupNewSystem.sh and every module
- Replace all curl ${DL_ROOT}/... downloads with cat of the matching
local files under ProjectCode/ConfigFiles (the dl.knownelement.com CDN
is no longer required for a git clone)
- Invoke modules by absolute path instead of cd ./Modules/X && bash ./x
- Fix secharden-audit-agents.sh: wrong path depth (../../ vs ../../..),
wrong Project-Includes glob, and ConfigFiles/AudidD -> AuditD typo,
all of which previously crashed the script
- Remove duplicate FrameworkVars source lines
Run from anywhere with: sudo bash ProjectCode/SetupNewSystem.sh
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
@@ -5,11 +5,10 @@
|
||||
#####
|
||||
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
export PROJECT_ROOT_PATH
|
||||
PROJECT_ROOT_PATH="$(realpath ../)"
|
||||
|
||||
#Framework variables are read from hee
|
||||
|
||||
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
export GIT_VENDOR_PATH_ROOT
|
||||
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
@@ -17,13 +16,22 @@ GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
||||
export KNELShellFrameworkRoot
|
||||
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
||||
|
||||
source $KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars
|
||||
export CONFIGFILES_PATH
|
||||
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
|
||||
|
||||
for framework_include_file in $KNELShellFrameworkRoot/Framework-Includes/*; do
|
||||
export MODULES_PATH
|
||||
MODULES_PATH="$PROJECT_ROOT_PATH/ProjectCode/Modules"
|
||||
|
||||
export SCRIPTS_PATH
|
||||
SCRIPTS_PATH="$PROJECT_ROOT_PATH/ProjectCode/scripts"
|
||||
|
||||
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
||||
|
||||
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
||||
source "$framework_include_file"
|
||||
done
|
||||
|
||||
for project_include_file in ../Project-Includes/*; do
|
||||
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
||||
source "$project_include_file"
|
||||
done
|
||||
|
||||
@@ -47,9 +55,6 @@ SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
|
||||
export LOCALUSER_CHECK
|
||||
LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
|
||||
|
||||
export DL_ROOT
|
||||
DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
|
||||
|
||||
#######################
|
||||
# Support functions
|
||||
#######################
|
||||
@@ -57,11 +62,9 @@ DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
|
||||
function global-oam() {
|
||||
print_info "Now running $FUNCNAME...."
|
||||
|
||||
cat ./scripts/up2date.sh >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
|
||||
cat "$SCRIPTS_PATH/up2date.sh" >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
|
||||
|
||||
cd Modules/OAM || exit
|
||||
bash ./oam-librenms.sh
|
||||
cd - || exit
|
||||
bash "$MODULES_PATH/OAM/oam-librenms.sh"
|
||||
|
||||
print_info "Completed running $FUNCNAME"
|
||||
|
||||
@@ -70,9 +73,9 @@ function global-oam() {
|
||||
function global-systemServiceConfigurationFiles() {
|
||||
print_info "Now running $FUNCNAME...."
|
||||
|
||||
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ZSH/tsys-zshrc >/etc/zshrc
|
||||
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/aliases >/etc/aliases
|
||||
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/Syslog/rsyslog.conf >/etc/rsyslog.conf
|
||||
cat "$CONFIGFILES_PATH/ZSH/tsys-zshrc" >/etc/zshrc
|
||||
cat "$CONFIGFILES_PATH/SMTP/aliases" >/etc/aliases
|
||||
cat "$CONFIGFILES_PATH/Syslog/rsyslog.conf" >/etc/rsyslog.conf
|
||||
|
||||
newaliases
|
||||
|
||||
@@ -235,7 +238,7 @@ function global-postPackageConfiguration() {
|
||||
|
||||
systemctl stop postfix
|
||||
|
||||
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/postfix_generic >/etc/postfix/generic
|
||||
cat "$CONFIGFILES_PATH/SMTP/postfix_generic" >/etc/postfix/generic
|
||||
postmap /etc/postfix/generic
|
||||
|
||||
postconf -e "inet_protocols = ipv4"
|
||||
@@ -262,33 +265,33 @@ function global-postPackageConfiguration() {
|
||||
|
||||
###Post package deployment bits
|
||||
|
||||
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/DHCP/dhclient.conf >/etc/dhcp/dhclient.conf
|
||||
cat "$CONFIGFILES_PATH/DHCP/dhclient.conf" >/etc/dhcp/dhclient.conf
|
||||
|
||||
systemctl stop snmpd && /etc/init.d/snmpd stop
|
||||
|
||||
cat ./ConfigFiles/SNMP/snmp-sudo.conf >/etc/sudoers.d/Debian-snmp
|
||||
cat "$CONFIGFILES_PATH/SNMP/snmp-sudo.conf" >/etc/sudoers.d/Debian-snmp
|
||||
sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service
|
||||
|
||||
pi-detect
|
||||
|
||||
if [ "$IS_RASPI" = 1 ]; then
|
||||
cat ./ConfigFiles/SNMP/snmpd-rpi.conf >/etc/snmp/snmpd.conf || true
|
||||
cat "$CONFIGFILES_PATH/SNMP/snmpd-rpi.conf" >/etc/snmp/snmpd.conf || true
|
||||
fi
|
||||
|
||||
if [ "$IS_PHYSICAL_HOST" = 1 ]; then
|
||||
cat ./ConfigFiles/SNMP/snmpd-physicalhost.conf >/etc/snmp/snmpd.conf || true
|
||||
cat "$CONFIGFILES_PATH/SNMP/snmpd-physicalhost.conf" >/etc/snmp/snmpd.conf || true
|
||||
fi
|
||||
|
||||
if [ "$IS_VIRT_GUEST" = 1 ]; then
|
||||
cat ./ConfigFiles/SNMP/snmpd.conf >/etc/snmp/snmpd.conf || true
|
||||
cat "$CONFIGFILES_PATH/SNMP/snmpd.conf" >/etc/snmp/snmpd.conf || true
|
||||
fi
|
||||
|
||||
systemctl daemon-reload && systemctl restart snmpd && /etc/init.d/snmpd restart
|
||||
|
||||
cat ./ConfigFiles/NetworkDiscovery/lldpd >/etc/default/lldpd
|
||||
cat "$CONFIGFILES_PATH/NetworkDiscovery/lldpd" >/etc/default/lldpd
|
||||
systemctl restart lldpd
|
||||
|
||||
cat ./ConfigFiles/Cockpit/disallowed-users >/etc/cockpit/disallowed-users
|
||||
cat "$CONFIGFILES_PATH/Cockpit/disallowed-users" >/etc/cockpit/disallowed-users
|
||||
systemctl restart cockpit
|
||||
|
||||
export LIBRENMS_CHECK
|
||||
@@ -305,7 +308,7 @@ function global-postPackageConfiguration() {
|
||||
|
||||
if [ "$NTP_SERVER_CHECK" -eq 0 ]; then
|
||||
|
||||
cat ./ConfigFiles/NTP/ntp.conf >/etc/ntpsec/ntp.conf
|
||||
cat "$CONFIGFILES_PATH/NTP/ntp.conf" >/etc/ntpsec/ntp.conf
|
||||
systemctl restart ntpsec.service
|
||||
fi
|
||||
|
||||
@@ -346,42 +349,32 @@ function global-postPackageConfiguration() {
|
||||
function secharden-ssh() {
|
||||
print_info "Now running $FUNCNAME"
|
||||
|
||||
cd ./Modules/Security || exit
|
||||
bash ./secharden-ssh.sh
|
||||
cd -
|
||||
bash "$MODULES_PATH/Security/secharden-ssh.sh"
|
||||
|
||||
print_info "Completed running $FUNCNAME"
|
||||
}
|
||||
|
||||
function secharden-wazuh() {
|
||||
print_info "Now running $FUNCNAME"
|
||||
cd ./Modules/Security || exit
|
||||
bash ./secharden-wazuh.sh
|
||||
cd -
|
||||
bash "$MODULES_PATH/Security/secharden-wazuh.sh"
|
||||
print_info "Completed running $FUNCNAME"
|
||||
}
|
||||
|
||||
function secharden-2fa() {
|
||||
print_info "Now running $FUNCNAME"
|
||||
cd ./Modules/Security || exit
|
||||
bash ./secharden-2fa.sh
|
||||
cd -
|
||||
bash "$MODULES_PATH/Security/secharden-2fa.sh"
|
||||
print_info "Completed running $FUNCNAME"
|
||||
}
|
||||
|
||||
function secharden-scap-stig() {
|
||||
print_info "Now running $FUNCNAME"
|
||||
cd ./Modules/Security || exit
|
||||
bash ./secharden-scap-stig.sh
|
||||
cd -
|
||||
bash "$MODULES_PATH/Security/secharden-scap-stig.sh"
|
||||
print_info "Completed running $FUNCNAME"
|
||||
}
|
||||
|
||||
function secharden-agents() {
|
||||
print_info "Now running $FUNCNAME"
|
||||
cd ./Modules/Security || exit
|
||||
bash ./secharden-audit-agents.sh
|
||||
cd -
|
||||
bash "$MODULES_PATH/Security/secharden-audit-agents.sh"
|
||||
print_info "Completed running $FUNCNAME"
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user