3 # fixes the cakelampvm permissions according to the way.
7 if [[ $EUID != 0 ]]; then
8 echo "This script must be run as root or sudo."
14 export WORKDIR="$( \cd "$(\dirname "$0")" && \pwd )" # obtain the script's working directory.
15 export FEISTY_MEOW_APEX="$( \cd "$WORKDIR/../.." && \pwd )"
18 source "$FEISTY_MEOW_APEX/scripts/core/launch_feisty_meow.sh"
19 source "$FEISTY_MEOW_SCRIPTS/system/common_sysadmin.sh"
23 # new requirement is to get the sql root password, since we need to do some sql db configuration.
24 echo -n "Please enter the MySQL root account password: "
26 if [ -z "$mysql_passwd" ]; then
27 echo "This script must have the sql root password to proceed."
35 echo "Regenerating feisty meow loading dock."
37 reconfigure_feisty_meow
38 test_or_die "feisty meow reconfiguration"
39 chown -R "$(logname)":"$(logname)" /home/$(logname)/.[a-zA-Z0-9]*
40 test_or_die "fix after reconfigured as sudo"
44 echo "Making some important permission changes..."
46 # fix up the main web storage.
47 chown -R www-data:www-data /var/www
48 test_or_die "chown www-data"
50 test_or_die "group_perm www-data"
54 # set up access on some important folders for the developer user.
55 chown -R developer:developer /home/developer /home/developer/.[a-zA-Z0-9]*
56 test_or_die "chown developer home"
57 harsh_perm /home/developer/.ssh
58 test_or_die "harsh_perm setting on developer .ssh"
59 chown -R developer:developer /etc/apache2 /etc/bind
60 test_or_die "chown apache2 and bind to developer"
61 group_perm /etc/apache2 /etc/bind
62 test_or_die "group perms on apache2 and bind"
66 # fix perms for fred user.
67 chown -R fred:fred /home/fred /home/archives/stuffing /home/fred/.[a-zA-Z0-9]*
68 test_or_die "chown fred home"
70 test_or_die "group perms on fred's apps"
71 harsh_perm /home/fred/.ssh
72 test_or_die "harsh_perm setting on fred .ssh"
73 chown -R fred:fred /opt/feistymeow.org
74 test_or_die "chown feisty meow to fred"
75 group_perm /opt/feistymeow.org
76 test_or_die "group perms on feisty meow"
77 group_perm /home/fred/apps/mapsdemo
78 test_or_die "group perms on mapsdemo app"
80 echo "Done with important permission changes."
84 # some slightly tricky bits start here. we want to massage the vm into the
85 # best possible shape without needing to re-release it.
91 echo "Updating developer welcome file."
93 # only update hello if they've still got the file there. we don't want to
94 # keep forcing our hellos at people.
95 if [ -f "$HOME/hello.txt" ]; then
96 # copy the most recent hello file into place for the user.
97 \cp -f "$FEISTY_MEOW_APEX/production/sites/cakelampvm.com/hello.txt" "$HOME"
98 test_or_continue "copying hello file for user"
103 # install a better editor app.
107 echo "The script is about to install the bluefish editor and some dependencies.
108 If the app is not already installed, then this process takes only about a
109 minute on a slower home DSL internet connection..."
111 apt-get install -y bluefish &> "/tmp/install_bluefish-$(logname).log"
112 test_or_continue "installing bluefish editor"
116 # deploy any site updates here to the VM's cakelampvm.com site.
118 # we want to upgrade the default apache site to the latest, since the new
119 # version mirrors the one on the internet (but with green checks instead
120 # of red X's) and since we also support https on the new default version.
121 # we can do this again later if needed, by upping the numbers on the apache
122 # site config files. our original site was 000 and the new version is 001,
123 # which we've done as a prefix on the config for some reason. makes the
124 # code below easy at least.
125 if [ -L /etc/apache2/sites-enabled/000-default.conf ]; then
129 # the old site is in place still, so let's update that.
130 echo "Updating default web sites to latest version."
133 test_or_die "enabling SSL for secure websites"
136 test_or_die "getting SSL loaded in apache"
138 a2dissite 000-default
139 test_or_die "disabling old apache site"
141 rm -f /etc/apache2/sites-available/000-default.conf
142 test_or_die "removing old apache site"
144 # copy in our new version of the default page.
145 #hmmm: would be nice if this worked without mods for any new version, besides just 001. see apache env var file below for example implem.
146 cp -f $FEISTY_MEOW_APEX/production/sites/cakelampvm.com/rolling/default_page.001/* \
147 /etc/apache2/sites-available
148 test_or_die "installing new apache default sites"
150 # there should only be ours at this version level and with that prefix.
152 test_or_die "enabling new apache default sites"
159 # fix up the apache site so that HSTS is disabled. otherwise we can't view
160 # the https site for cakelampvm.com once the domain name switch has occurred.
164 # we operate only on our own specialized tls conf file. hopefully no one has messed with it besides revamp.
165 # note the use of the character class :blank: below to match spaces or tabs.
166 search_replace "^[[:blank:]]*Header always set Strict-Transport-Security.*" "# not good for cakelampvm.com -- Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains;\"" /etc/apache2/conf-library/tls-enabling.conf
167 if [ $? -ne 0 ]; then
168 echo the apache tls-enabling.conf file seems to have already been patched to disable strict transport security.
171 echo successfully patched the apache tls-enabling.conf file to disable strict transport security.
176 # fix up bind so that we think of any address with cakelampvm.com on the end
177 # as being on the vm. this is already true for some specific sites, but we
178 # want the wildcard enabled to ease the use of DNS for windows folks.
182 grep -q "\*[[:blank:]]*IN A[[:blank:]]*10.28.42.20" /etc/bind/cakelampvm.com.conf
183 if [ $? -eq 0 ]; then
185 echo the bind settings for wildcard domains off of cakelampvm.com seems to already be present.
192 ; our bind magic, a wildcard domain, for all other sites with cakelampvm.com
193 ; in the domain. this forces any other sites besides the ones above to route
194 ; to the actual vm IP address, which currently is singular and very fixated.
196 IN HINFO "linux vm" "ubuntu"
202 " >> /etc/bind/cakelampvm.com.conf
204 echo "successfully added wildcard domains to the cakelampvm.com bind configuration."
209 # fix samba configuration for (ass-headed) default of read-only in user homes.
210 # why cripple a necessary feature by default?
214 pattern="[#;][[:blank:]]*read only = yes"
215 replacement="read only = no"
217 # we just always do the replacement now, after realizing the sentinel pattern
218 # was acutally already in the file... too much subtlety can get one into trouble.
219 sed -i "0,/$pattern/{s/$pattern/$replacement/}" /etc/samba/smb.conf
220 test_or_die "patching samba configuration to enable write acccess on user home dirs"
221 # sweet, looks like that worked...
223 echo successfully patched the samba configuration to enable writes on user home directories.
227 # set up some crucial users in the mysql db that we seem to have missed previously.
231 mysql -u root -p"$mysql_passwd" <<EOF
232 create user if not exists 'root'@'%' IDENTIFIED BY '$mysql_passwd';
233 grant all privileges on *.* TO 'root'@'%' with grant option;
235 create user if not exists 'wampcake'@'%' IDENTIFIED BY 'bakecamp';
236 grant all privileges on *.* TO 'wampcake'@'%' with grant option;
238 create user if not exists 'lampcake'@'%' IDENTIFIED BY 'bakecamp';
239 grant all privileges on *.* TO 'lampcake'@'%' with grant option;
241 test_or_die "configuring root, wampcake and lampcake users on mysql"
245 # add the latest version of the cakelampvm environment variables for apache.
249 # drop existing file, if already configured. ignore errors.
250 a2disconf env_vars_cakelampvm &>/dev/null
252 # plug in the new version, just stomping anything there.
253 # note: we only expect to have one version of the env_vars dir at a time in place in feisty...
254 cp -f $FEISTY_MEOW_APEX/production/sites/cakelampvm.com/rolling/env_vars.*/env_vars_cakelampvm.conf /etc/apache2/conf-available
255 test_or_die "copying environment variables file into place"
257 # enable the new version of the config file.
258 a2enconf env_vars_cakelampvm
259 test_or_die "enabling the new cakelampvm environment config for apache"
261 echo Successfully configured the apache2 environment variables needed for cakelampvm.
266 # sequel--tell them they're great and show the hello again also.
271 test_or_die "regenerating feisty meow scripts"
272 chown -R "$(logname)":"$(logname)" /home/$(logname)/.[a-zA-Z0-9]*
273 test_or_die "fix after regenerate as sudo"
277 Thanks for revamping your cakelampvm. :-)