propellor/Propellor.hs

79 lines
2.6 KiB
Haskell
Raw Normal View History

2014-03-30 19:31:57 +00:00
import Common
2014-03-30 23:10:32 +00:00
import CmdLine
2014-03-30 17:12:33 +00:00
import qualified Property.File as File
import qualified Property.Apt as Apt
import qualified Property.Ssh as Ssh
import qualified Property.User as User
2014-03-30 03:45:48 +00:00
import qualified Property.Hostname as Hostname
import qualified Property.Reboot as Reboot
2014-03-30 04:38:16 +00:00
import qualified Property.Tor as Tor
import qualified Property.GitHome as GitHome
2014-03-30 04:08:02 +00:00
main :: IO ()
2014-03-30 23:10:32 +00:00
main = defaultMain getProperties
2014-03-30 04:08:02 +00:00
{- This is where the system's HostName, either as returned by uname
2014-03-30 06:26:23 +00:00
- or one specified on the command line, is converted into a list of
2014-03-30 04:08:02 +00:00
- Properties for that system. -}
getProperties :: HostName -> [Property]
2014-03-30 06:26:23 +00:00
getProperties hostname@"clam.kitenet.net" =
[ cleanCloudAtCost hostname
2014-03-30 06:12:48 +00:00
, standardSystem Apt.Unstable
2014-03-30 23:25:01 +00:00
, User.hasPassword "root"
, User.hasPassword "joey"
2014-03-30 20:15:27 +00:00
-- Clam is a tor bridge.
, Tor.isBridge
2014-03-30 23:10:32 +00:00
, Apt.installed ["docker.io"]
2014-03-30 06:12:48 +00:00
-- This is not an important system so I don't want to need to
-- manually upgrade it.
, Apt.unattendedUpgrades True
-- Should come last as it reboots.
2014-03-30 17:39:09 +00:00
, Apt.installed ["systemd-sysv"] `onChange` Reboot.now
2014-03-30 06:12:48 +00:00
]
-- add more hosts here...
--getProperties "foo" =
2014-03-30 20:15:27 +00:00
getProperties h = error $ unwords
[ "Unknown host:", h
, "(perhaps you should specify the real hostname on the command line?)"
]
2014-03-30 06:12:48 +00:00
-- This is my standard system setup
2014-03-30 06:26:23 +00:00
standardSystem :: Apt.Suite -> Property
standardSystem suite = propertyList "standard system"
2014-03-30 06:12:48 +00:00
[ Apt.stdSourcesList suite `onChange` Apt.upgrade
2014-03-30 04:28:56 +00:00
, Apt.installed ["etckeeper"]
, Apt.installed ["ssh"]
, GitHome.installedFor "root"
2014-03-30 04:28:56 +00:00
-- Harden the system, but only once root's authorized_keys
-- is safely in place.
, check (Ssh.hasAuthorizedKeys "root") $
Ssh.passwordAuthentication False
2014-03-30 04:17:44 +00:00
, check (Ssh.hasAuthorizedKeys "root") $
User.lockedPassword "root"
2014-03-30 05:49:11 +00:00
, Apt.installed ["vim"]
2014-03-30 19:53:35 +00:00
, User.sshAccountFor "joey"
, Apt.installed ["sudo"]
2014-03-30 06:12:48 +00:00
-- nopasswd because no password is set up for joey.
2014-03-30 20:49:59 +00:00
, "sudoer joey" ==>
"/etc/sudoers" `File.containsLine` "joey ALL=(ALL:ALL) NOPASSWD:ALL"
, GitHome.installedFor "joey"
2014-03-30 20:15:27 +00:00
-- I use postfix, or no MTA.
, Apt.removed ["exim4"] `onChange` Apt.autoRemove
]
2014-03-30 06:26:23 +00:00
-- Clean up a system as installed by cloudatcost.com
cleanCloudAtCost :: HostName -> Property
cleanCloudAtCost hostname = propertyList "cloudatcost cleanup"
2014-03-30 20:53:31 +00:00
[ Hostname.set hostname
2014-03-30 06:26:23 +00:00
, Ssh.uniqueHostKeys
2014-03-30 20:49:59 +00:00
, "worked around grub/lvm boot bug #743126" ==>
"/etc/default/grub" `File.containsLine` "GRUB_DISABLE_LINUX_UUID=true"
2014-03-30 17:39:09 +00:00
`onChange` cmdProperty "update-grub" []
`onChange` cmdProperty "update-initramfs" [Param "-u"]
2014-03-30 20:53:31 +00:00
, "nuked cloudatcost cruft" ==> combineProperties
[ File.notPresent "/etc/rc.local"
, File.notPresent "/etc/init.d/S97-setup.sh"
, User.nuked "user" User.YesReallyDeleteHome
]
2014-03-30 06:26:23 +00:00
]