mirror of
https://github.com/zulip/zulip.git
synced 2025-11-01 20:44:04 +00:00
87632c6526
If you use persistent ssh connections, ssh'ing as admin will cause a sshd process to hang around on the server, preventing us from deleting the admin account. Therefore, we disable persistent connections for that ssh connection. (imported from commit 2d043768417d20ef2f12695475a20b74bf3374de)
114 lines
3.4 KiB
Bash
Executable File
114 lines
3.4 KiB
Bash
Executable File
#!/bin/bash -xe
|
|
|
|
server=$1
|
|
type=$2
|
|
hostname=$3
|
|
if [ -z "$hostname" ]; then
|
|
echo "USAGE: $0 server type hostname"
|
|
exit 1
|
|
fi
|
|
if ! $(echo "$hostname" | grep -q zulip); then
|
|
echo "USAGE: $0 server type hostname"
|
|
echo "Hostname must have zulip in it."
|
|
exit 1
|
|
fi
|
|
|
|
zulip_root=${ZULIP_ROOT:-$HOME/zulip}
|
|
|
|
amazon_key_file=$zulip_root/zulip.pem
|
|
if ! [ -e "$amazon_key_file" ]; then
|
|
echo "You need zulip.pem at $amazon_key_file; ask tabbott for it"
|
|
exit 1
|
|
fi
|
|
|
|
server_private_key_file=$zulip_root/puppet/zulip_internal/files/id_rsa
|
|
if ! [ -e "$server_private_key_file" ]; then
|
|
echo "You need a server ssh key at $server_private_key_file"
|
|
exit 1
|
|
fi
|
|
|
|
# Force RSA keys. We do this because the ECDSA key is not printed on syslog,
|
|
# and our puppet configuration does not use ECDSA. If we don't do this,
|
|
# we'll get key errors after puppet apply.
|
|
SSH_OPTS="-o HostKeyAlgorithms=ssh-rsa"
|
|
|
|
set +e
|
|
|
|
ssh $SSH_OPTS "$server" -t -i "$amazon_key_file" -ladmin -o "ControlMaster=no" <<EOF
|
|
sudo sed -i 's/PermitRootLogin no/PermitRootLogin yes/g' /etc/ssh/sshd_config
|
|
sudo mkdir ~root/.ssh && sudo cp .ssh/authorized_keys ~root/.ssh/authorized_keys
|
|
sudo service ssh restart
|
|
|
|
EOF
|
|
|
|
set -e
|
|
|
|
ssh $SSH_OPTS "$server" -t -i "$amazon_key_file" -lroot <<EOF
|
|
resize2fs /dev/xvda1
|
|
echo "$hostname" > /etc/hostname
|
|
sed -i 's/localhost$/localhost $hostname/' /etc/hosts
|
|
/etc/init.d/hostname.sh start
|
|
|
|
# First, install any updates from the apt repo that may be needed
|
|
cat >/etc/apt/sources.list.d/zulip.list <<EOF2
|
|
deb http://apt.zulip.com/ops wheezy main
|
|
EOF2
|
|
apt-get update
|
|
apt-get -y upgrade
|
|
|
|
# need to get puppet before we can do anything with puppet
|
|
apt-get install -y puppet git
|
|
EOF
|
|
|
|
# Give new server git access
|
|
# TODO: Don't give servers push access to our git!
|
|
scp $SSH_OPTS -i "$amazon_key_file" "$server_private_key_file" root@"$server":/root/.ssh/id_rsa
|
|
|
|
ssh $SSH_OPTS "$server" -t -i "$amazon_key_file" -lroot <<EOF
|
|
chmod 600 /root/.ssh/id_rsa
|
|
# Setup initial known_hosts including git server
|
|
cat > /root/.ssh/known_hosts <<EOF2
|
|
git.zulip.net ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDjW3wKDRuah6XT5a7Xta+S2d5ew1ZPxWTbKKgp6Cun111zFw1bvLGSKS0W3HnbXOyXLbVVsAH/cSNFHMvH2nitM15zp7w2w3NV8YbLZCkdFXp5KeKHuBQ+DYL+nDCKjunlrDfxDXvD7jn/wMN995ZsnEJqnc7N8uzIgt+5lbmie5jz3Xbt/7gQdjG5E0xGL7DzzJPp8kBzfE6B1qr5pWLVKXMuGXLCcbMaco5kEjRuM8dPrtG3kGG2YsjOkoHIqwtRwztXEmjklt1FFI06JYsW43PjmdP586nOg7n28k1ibhlF968PmRRX7USI7jJ+awPd/XH4neCdNG2f8JL2kRD
|
|
EOF2
|
|
# clone zulip repository
|
|
cd /root
|
|
rm -rf /root/zulip
|
|
git clone git@git.zulip.net:eng/zulip.git
|
|
cd /root/zulip
|
|
git checkout master
|
|
EOF
|
|
|
|
ssh $SSH_OPTS "$server" -t -i "$amazon_key_file" -lroot <<EOF
|
|
cp -a /root/zulip/puppet/zulip/files/puppet.conf /etc/puppet/
|
|
|
|
userdel admin
|
|
passwd -d root
|
|
mkdir /etc/zulip
|
|
echo -e "[machine]\npuppet_classes =" $type > /etc/zulip/zulip.conf
|
|
/root/zulip/scripts/zulip-puppet-apply -f
|
|
cp -a /root/zulip /home/zulip/zulip
|
|
chown -R zulip:zulip /home/zulip/zulip
|
|
# These server restarting bits should be moveable into puppet-land, ideally
|
|
apt-get -y upgrade
|
|
if [ -e "/etc/init.d/nginx" ]; then
|
|
service nginx restart
|
|
fi
|
|
if [ -e "/etc/init.d/apache2" ]; then
|
|
service apache2 restart
|
|
fi
|
|
|
|
EOF
|
|
|
|
# TODO: Don't give servers push access to our git!
|
|
scp $SSH_OPTS -i "$amazon_key_file" "$server_private_key_file" zulip@"$server":/home/zulip/.ssh/id_rsa
|
|
ssh $SSH_OPTS "$server" -t -i "$amazon_key_file" -lzulip <<EOF
|
|
chmod 600 /home/zulip/.ssh/id_rsa
|
|
EOF
|
|
|
|
set +x
|
|
cat <<EOF
|
|
|
|
Done.
|
|
|
|
EOF
|