From c6c3577b0b3cb28a80a42cee63e5544d7a010735 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Zolt=C3=A1n=20Felleg?= <zoltan.felleg@userrendszerhaz.hu>
Date: Wed, 7 Nov 2018 12:23:11 +0100
Subject: [PATCH] Added ens.pm.f29.

---
 sources/ens.pm.f29/config                     |  19 ++
 sources/ens.pm.f29/envvars                    |   4 +
 .../firstboot/01_setupnetworking.sh           |  55 ++++++
 .../ens.pm.f29/firstboot/02_settimezone.sh    |  21 ++
 sources/ens.pm.f29/firstboot/03_setupldap.sh  |  10 +
 sources/ens.pm.f29/firstboot/99_cleanup.sh    |   6 +
 .../ens.pm.f29/postinstall/01_setownership.sh |   9 +
 .../postinstall/02_setpermissions.sh          |   7 +
 .../ens.pm.f29/postinstall/03_installfiles.sh |  15 ++
 .../postinstall/10_setupservices.sh           |   7 +
 sources/ens.pm.f29/postinstall/99_cleanup.sh  |   6 +
 .../ens.pm.f29/postinstall/install/etc/hosts  |   4 +
 .../postinstall/install/etc/named.conf        | 180 ++++++++++++++++++
 .../install/etc/sysctl.d/01-ipv6.conf         |   2 +
 14 files changed, 345 insertions(+)
 create mode 100644 sources/ens.pm.f29/config
 create mode 100644 sources/ens.pm.f29/envvars
 create mode 100755 sources/ens.pm.f29/firstboot/01_setupnetworking.sh
 create mode 100755 sources/ens.pm.f29/firstboot/02_settimezone.sh
 create mode 100755 sources/ens.pm.f29/firstboot/03_setupldap.sh
 create mode 100755 sources/ens.pm.f29/firstboot/99_cleanup.sh
 create mode 100755 sources/ens.pm.f29/postinstall/01_setownership.sh
 create mode 100755 sources/ens.pm.f29/postinstall/02_setpermissions.sh
 create mode 100755 sources/ens.pm.f29/postinstall/03_installfiles.sh
 create mode 100755 sources/ens.pm.f29/postinstall/10_setupservices.sh
 create mode 100755 sources/ens.pm.f29/postinstall/99_cleanup.sh
 create mode 100644 sources/ens.pm.f29/postinstall/install/etc/hosts
 create mode 100644 sources/ens.pm.f29/postinstall/install/etc/named.conf
 create mode 100644 sources/ens.pm.f29/postinstall/install/etc/sysctl.d/01-ipv6.conf

diff --git a/sources/ens.pm.f29/config b/sources/ens.pm.f29/config
new file mode 100644
index 0000000..2b2cfd4
--- /dev/null
+++ b/sources/ens.pm.f29/config
@@ -0,0 +1,19 @@
+lxc.include = /usr/share/lxc/config/common.conf
+
+lxc.arch = x86_64
+lxc.uts.name = ens.pm.user.hu
+lxc.rootfs.path = __CONTAINER_PATH__/rootfs
+lxc.mount.auto = proc:rw sys:ro
+
+lxc.net.0.type = veth
+lxc.net.0.flags = up
+lxc.net.0.link = brh
+lxc.net.0.hwaddr = 02:0c:18:03:ad:40
+
+lxc.autodev = 1
+
+lxc.signal.halt = SIGRTMIN+4
+
+lxc.start.auto = 1
+lxc.start.order = 11
+lxc.start.delay = 10
diff --git a/sources/ens.pm.f29/envvars b/sources/ens.pm.f29/envvars
new file mode 100644
index 0000000..225fcb0
--- /dev/null
+++ b/sources/ens.pm.f29/envvars
@@ -0,0 +1,4 @@
+#BASE_PACKAGES="NetworkManager initscripts openssh-server openssh-clients openssh-ldap rootfiles rsyslog sudo tar vim-minimal"
+#SPEC_PACKAGES="authselect bind bind-utils openldap-clients nss-pam-ldapd pam_ssh passwd"
+BASE_PACKAGES="NetworkManager initscripts rootfiles rsyslog tar"
+SPEC_PACKAGES="bind bind-utils"
diff --git a/sources/ens.pm.f29/firstboot/01_setupnetworking.sh b/sources/ens.pm.f29/firstboot/01_setupnetworking.sh
new file mode 100755
index 0000000..d0ee46d
--- /dev/null
+++ b/sources/ens.pm.f29/firstboot/01_setupnetworking.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+
+sleep 1
+systemctl --quiet is-active NetworkManager.service
+NM_RC=$?
+WAITED=0
+while [ $NM_RC -ne 0 ]
+do
+    echo -n .
+    sleep 1
+    WAITED=1
+    systemctl --quiet is-active NetworkManager.service
+    NM_RC=$?
+done
+[ $WAITED -ne 0 ] && echo
+
+CONNECTIONS=$(nmcli connection show | grep -v '^NAME' | wc -l)
+if [ $CONNECTIONS -ne 1 ]
+then
+    echo "Number of connections: $CONNECTIONS" >&2
+    exit 1
+fi
+
+CONNECTION_LINE=$(nmcli connection show | grep -v '^NAME')
+CONNECTION_TOKENS=$(echo $CONNECTION_LINE | wc -w)
+#CONNECTION_NAME_POS=$(( $CONNECTION_TOKENS - 3 ))
+CONNECTION_UUID_POS=$(( $CONNECTION_TOKENS - 2 ))
+#CONNECTION_TYPE_POS=$(( $CONNECTION_TOKENS - 1 ))
+CONNECTION_DEVICE_POS=$CONNECTION_TOKENS
+#CONNECTION_NAME=$(echo $CONNECTION_LINE \
+#                      | cut -f -$CONNECTION_NAME_POS -d ' ')
+CONNECTION_UUID=$(echo $CONNECTION_LINE \
+                      | cut -f $CONNECTION_UUID_POS -d ' ')
+#CONNECTION_TYPE=$(echo $CONNECTION_LINE \
+#                      | cut -f $CONNECTION_TYPE_POS -d ' ')
+CONNECTION_DEVICE=$(echo $CONNECTION_LINE \
+                        | cut -f $CONNECTION_DEVICE_POS -d ' ')
+
+nmcli connection delete uuid "$CONNECTION_UUID"
+
+nmcli connection add \
+    type 802-3-ethernet \
+    ifname $CONNECTION_DEVICE \
+    con-name perimeter \
+    autoconnect yes \
+    save yes \
+    ipv4.addresses "192.168.173.64/24" \
+    ipv4.dns "192.168.173.174" \
+    ipv4.dns-search "pm.user.hu" \
+    ipv4.gateway "192.168.173.254" \
+    ipv4.method "manual" \
+    ipv4.routes "10.228.0.0/16 192.168.173.1" \
+    ipv6.method "ignore"
+nmcli connection show
diff --git a/sources/ens.pm.f29/firstboot/02_settimezone.sh b/sources/ens.pm.f29/firstboot/02_settimezone.sh
new file mode 100755
index 0000000..20b2a71
--- /dev/null
+++ b/sources/ens.pm.f29/firstboot/02_settimezone.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+
+sleep 1
+systemctl --quiet is-active dbus.service
+DBUS_RC=$?
+WAITED=0
+while [ $DBUS_RC -ne 0 ]
+do
+    if [ $WAITED -eq 0 ]
+    then
+        echo -n "Waiting for dbus.service"
+    fi
+    echo -n .
+    sleep 1
+    WAITED=1
+    systemctl --quiet is-active dbus.service
+    DBUS_RC=$?
+done
+[ $WAITED -ne 0 ] && echo
+timedatectl set-timezone Europe/Budapest
diff --git a/sources/ens.pm.f29/firstboot/03_setupldap.sh b/sources/ens.pm.f29/firstboot/03_setupldap.sh
new file mode 100755
index 0000000..4b58626
--- /dev/null
+++ b/sources/ens.pm.f29/firstboot/03_setupldap.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+
+exit 0
+authselect select sssd with-mkhomedir --force
+
+cat >>/etc/openldap/ldap.conf <<EOF
+BASE dc=user,dc=hu
+URI ldap://ldap.usr.user.hu
+EOF
diff --git a/sources/ens.pm.f29/firstboot/99_cleanup.sh b/sources/ens.pm.f29/firstboot/99_cleanup.sh
new file mode 100755
index 0000000..b87f2f4
--- /dev/null
+++ b/sources/ens.pm.f29/firstboot/99_cleanup.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+
+REAL_PATH=$(dirname $(realpath $0))
+
+echo rm -Rf $REAL_PATH
diff --git a/sources/ens.pm.f29/postinstall/01_setownership.sh b/sources/ens.pm.f29/postinstall/01_setownership.sh
new file mode 100755
index 0000000..224e4d8
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/01_setownership.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+
+REAL_PATH=$(dirname $(realpath $0))
+SOURCE_PATH=$REAL_PATH/install
+
+chown -R root.root $SOURCE_PATH/*
+
+chgrp named $SOURCE_PATH/etc/named.*
diff --git a/sources/ens.pm.f29/postinstall/02_setpermissions.sh b/sources/ens.pm.f29/postinstall/02_setpermissions.sh
new file mode 100755
index 0000000..68ca2bc
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/02_setpermissions.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+
+REAL_PATH=$(dirname $(realpath $0))
+SOURCE_PATH=$REAL_PATH/install
+
+chmod 640 $SOURCE_PATH/etc/named.*
diff --git a/sources/ens.pm.f29/postinstall/03_installfiles.sh b/sources/ens.pm.f29/postinstall/03_installfiles.sh
new file mode 100755
index 0000000..f190caf
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/03_installfiles.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+
+REAL_PATH=$(dirname $(realpath $0))
+
+tar --create \
+    --directory=$REAL_PATH \
+    --to-stdout \
+    install \
+    | tar --extract \
+          --backup \
+          --directory=/ \
+          --no-overwrite-dir \
+          --strip-components=1 \
+          --suffix=.orig
diff --git a/sources/ens.pm.f29/postinstall/10_setupservices.sh b/sources/ens.pm.f29/postinstall/10_setupservices.sh
new file mode 100755
index 0000000..c9bfc34
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/10_setupservices.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+
+systemctl enable named.service
+systemctl enable NetworkManager-wait-online.service
+
+systemctl mask wpa_supplicant.service
diff --git a/sources/ens.pm.f29/postinstall/99_cleanup.sh b/sources/ens.pm.f29/postinstall/99_cleanup.sh
new file mode 100755
index 0000000..b87f2f4
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/99_cleanup.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+
+REAL_PATH=$(dirname $(realpath $0))
+
+echo rm -Rf $REAL_PATH
diff --git a/sources/ens.pm.f29/postinstall/install/etc/hosts b/sources/ens.pm.f29/postinstall/install/etc/hosts
new file mode 100644
index 0000000..cf63c48
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/install/etc/hosts
@@ -0,0 +1,4 @@
+127.0.0.1	localhost.localdomain localhost localhost4.localdomain4 localhost4
+::1		localhost6.localdomain6 localhost6
+
+192.168.173.64	ens.pm.user.hu ens
diff --git a/sources/ens.pm.f29/postinstall/install/etc/named.conf b/sources/ens.pm.f29/postinstall/install/etc/named.conf
new file mode 100644
index 0000000..b2e5f0a
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/install/etc/named.conf
@@ -0,0 +1,180 @@
+//
+// named.conf
+//
+
+options {
+	directory		"/var/named";
+	dump-file		"data/cache_dump.db";
+	statistics-file		"data/named_stats.txt";
+	memstatistics-file	"data/named_mem_stats.txt";
+
+	listen-on	port 53 { any; };
+	listen-on-v6	port 53 { any; };
+
+	allow-query		{ none; };
+	allow-query-cache	{ none; };
+	allow-recursion		{ none; };
+
+	recursion	no;
+
+	dnssec-enable		yes;
+	dnssec-validation	auto;
+
+	random-device		"/dev/urandom";
+};
+
+logging {
+        channel default_debug {
+                file "data/named.run" versions 3 size 5m;
+                severity dynamic;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+        };
+	channel client_channel {
+		file "data/client.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel lame-servers_channel {
+		file "data/lame-servers.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel notify_channel {
+		file "data/notify.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel queries_channel {
+		file "data/queries.log" versions 3 size 5m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel security_channel {
+		file "data/security.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel xfer-in_channel {
+		file "data/xfer-in.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	channel xfer-out_channel {
+		file "data/xfer-out.log" versions 3 size 1m;
+		severity info;
+		print-category yes;
+		print-severity yes;
+		print-time yes;
+	};
+	category default {
+		default_syslog;
+		default_debug;
+	};
+	category client {
+		client_channel;
+	};
+	category lame-servers {
+		lame-servers_channel;
+	};
+	category notify {
+		notify_channel;
+	};
+	category queries {
+		queries_channel;
+	};
+	category security {
+		security_channel;
+	};
+	category xfer-in {
+		xfer-in_channel;
+	};
+	category xfer-out {
+		xfer-out_channel;
+	};
+};
+
+key "primary_ns-external_ns" {
+	algorithm hmac-sha256;
+	secret "4ekZY173EctYMvyy9XaCAMhB5bpU7gHNTPiJ0m8ajBA=";
+};
+key "peep_bo_ns-user_ns" {
+	algorithm hmac-sha256;
+	secret "TlqKwJQhMZJ1sfS7eQxJIrGrysvhylWuvIIPLi5dQiw=";
+};
+
+acl primary_ns_key_acl		{ key "primary_ns-external_ns"; };
+acl peep_bo_ns_key_acl		{ key "peep_bo_ns-user_ns"; };
+acl invitel_nsm_ns_ip_acl	{ 213.163.0.156; };
+
+masters primary_ns_master	{ 10.228.109.174 key "primary_ns-external_ns"; };
+masters peep_bo_ns_master	{ 195.228.46.236 key "peep_bo_ns-user_ns"; };
+masters invitel_nsm_ns_master	{ 213.163.0.156; };
+
+server 10.228.109.174	{ keys { "primary_ns-external_ns"; }; };
+server 195.228.46.236	{ keys { "peep_bo_ns-user_ns"; }; };
+
+view "external" {
+	match-clients		{ ! localnets; ! localhost; any; };
+
+	allow-query		{ ! localnets; ! localhost; any; };
+	allow-query-cache	{ none; };
+	allow-recursion		{ none; };
+	allow-transfer		{ none; };
+	allow-update		{ none; };
+
+	notify			no;
+
+	recursion		no;
+
+	# external zones
+	zone "useribm.hu" IN {
+		type slave;
+		masters { primary_ns_master; };
+		file "slaves/useribm.hu.zone";
+
+		allow-transfer		{ invitel_nsm_ns_ip_acl; };
+		allow-notify		{ primary_ns_key_acl; };
+		notify			explicit;
+		also-notify		{ invitel_nsm_ns_master; };
+	};
+	zone "userrendszerhaz.hu" IN {
+		type slave;
+		masters { primary_ns_master; };
+		file "slaves/userrendszerhaz.hu.zone";
+
+		allow-transfer		{ invitel_nsm_ns_ip_acl; };
+		allow-notify		{ primary_ns_key_acl; };
+		notify			explicit;
+		also-notify		{ invitel_nsm_ns_master; };
+	};
+
+	# peep-bo zones
+	zone "qqcs.org" IN {
+		type slave;
+		masters { peep_bo_ns_master; };
+		file "slaves/qqcs.org.zone.signed";
+
+		allow-notify		{ peep_bo_ns_key_acl; };
+	};
+	zone "kukucs.org" IN {
+		type slave;
+		masters { peep_bo_ns_master; };
+		file "slaves/kukucs.org.zone.signed";
+
+		allow-notify		{ peep_bo_ns_key_acl; };
+	};
+};
diff --git a/sources/ens.pm.f29/postinstall/install/etc/sysctl.d/01-ipv6.conf b/sources/ens.pm.f29/postinstall/install/etc/sysctl.d/01-ipv6.conf
new file mode 100644
index 0000000..0690211
--- /dev/null
+++ b/sources/ens.pm.f29/postinstall/install/etc/sysctl.d/01-ipv6.conf
@@ -0,0 +1,2 @@
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.svc.disable_ipv6 = 1
-- 
2.54.0