6 # Set PATH to find our own executables
7 export PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:${PATH}
9 # Exoscale only supports a MTU of 1500
15 wget
-qO - "http://metadata.exoscale.com/latest/${file}"
18 import_exoscale_configuration
() {
19 local instance_id
="$(get meta-data/instance-id)"
21 boot_mesg
"Importing Exoscale configuration for instance ${instance_id}..."
24 echo "${instance_id}" > /var
/run
/exoscale-instance-id
26 # Initialise system settings
27 local hostname
=$
(get meta-data
/local-hostname
)
30 if ! grep -q "^HOSTNAME=" /var
/ipfire
/main
/settings
; then
31 echo "HOSTNAME=${hostname%%.*}" >> /var
/ipfire
/main
/settings
35 if ! grep -q "^DOMAINNAME=" /var
/ipfire
/main
/settings
; then
36 local domainname
="${hostname#*.}"
38 # Fall back to localdomain
39 [ -z "${domainname}" ] && domainname
="localdomain"
41 echo "DOMAINNAME=${domainname}" >> /var
/ipfire
/main
/settings
45 if ! getent passwd setup
&>/dev
/null
; then
46 useradd setup
-s /usr
/bin
/run-setup
-g nobody
-m
52 # Import SSH keys for setup user
54 for line
in $
(get
"meta-data/public-keys/"); do
55 local key_no
="${line%=*}"
57 local key
="$(get meta-data/public-keys/${key_no}/openssh-key)"
58 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev
/null
; then
59 mkdir
-p "/home/setup/.ssh"
60 chmod 700 "/home/setup/.ssh"
61 chown setup.nobody
"/home/setup/.ssh"
63 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
64 chmod 600 "/home/setup/.ssh/authorized_keys"
65 chown setup.nobody
"/home/setup/.ssh/authorized_keys"
69 # Download the user-data script only on the first boot
70 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
72 local user_data
="$(get user-data)"
74 # Save user-data script to be executed later
75 if [ "${user_data:0:2}" = "#!" ]; then
76 echo "${user_data}" > /tmp
/user-data.
script
77 chmod 700 /tmp
/user-data.
script
79 # Run the user-data script
80 local now
="$(date -u +"%s
")"
81 /tmp
/user-data.
script &>/var
/log
/user-data.log.
${now}
83 # Delete the script right away
84 rm /tmp
/user-data.
script
88 # Import any previous settings for the local interfaces
89 eval $
(/usr
/local
/bin
/readhash
<(grep -E "^(GREEN|ORANGE)_.*=" /var
/ipfire
/ethernet
/settings
2>/dev
/null
))
91 # Import network configuration
92 # After this, no network connectivity will be available from this script due to the
93 # renaming of the network interfaces for which they have to be shut down
95 : > /var
/ipfire
/ethernet
/settings
98 for device
in /sys
/class
/net
/*; do
99 # Fetch the interface index
100 local ifindex
="$(<${device}/ifindex)"
101 local address
="$(<${device}/address)"
109 # The first interface will always be the public-facing one (i.e. RED)
114 echo "RED_MACADDR=${address}"
115 echo "RED_DESCRIPTION='${ifindex}'"
117 ) >> /var
/ipfire
/ethernet
/settings
122 # Set some sensible defaults for GREEN
123 if [ -z "${GREEN_ADDRESS}" ]; then
124 GREEN_ADDRESS
="10.0.0.1"
125 GREEN_NETMASK
="255.255.255.0"
126 GREEN_NETADDRESS
="10.0.0.0"
127 GREEN_BROADCAST
="10.0.0.255"
131 echo "GREEN_DEV=green0"
132 echo "GREEN_MACADDR=${address}"
133 echo "GREEN_DESCRIPTION='${ifindex}'"
134 echo "GREEN_ADDRESS=${GREEN_ADDRESS}"
135 echo "GREEN_NETMASK=${GREEN_NETMASK}"
136 echo "GREEN_NETADDRESS=${GREEN_NETADDRESS}"
137 echo "GREEN_BROADCAST=${GREEN_BROADCAST}"
138 echo "GREEN_MTU=${DEFAULT_MTU}"
139 ) >> /var
/ipfire
/ethernet
/settings
146 # Set some sensible defaults for ORANGE
147 if [ -z "${ORANGE_ADDRESS}" ]; then
148 ORANGE_ADDRESS
="10.0.1.1"
149 ORANGE_NETMASK
="255.255.255.0"
150 ORANGE_NETADDRESS
="10.0.1.0"
151 ORANGE_BROADCAST
="10.0.1.255"
155 echo "ORANGE_DEV=orange0"
156 echo "ORANGE_MACADDR=${address}"
157 echo "ORANGE_DESCRIPTION='${ifindex}'"
158 echo "ORANGE_ADDRESS=${ORANGE_ADDRESS}"
159 echo "ORANGE_NETMASK=${ORANGE_NETMASK}"
160 echo "ORANGE_NETADDRESS=${ORANGE_NETADDRESS}"
161 echo "ORANGE_BROADCAST=${ORANGE_BROADCAST}"
162 echo "ORANGE_MTU=${DEFAULT_MTU}"
163 ) >> /var
/ipfire
/ethernet
/settings
169 echo "CONFIG_TYPE=${config_type}" >> /var
/ipfire
/ethernet
/settings
171 # Actions performed only on the very first start
172 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
173 # Disable using ISP nameservers
174 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var
/ipfire
/dns
/settings
177 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var
/ipfire
/remote
/settings
179 # Disable SSH password authentication
180 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var
/ipfire
/remote
/settings
182 # Enable SSH key authentication
183 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var
/ipfire
/remote
/settings
186 /usr
/local
/bin
/sshctrl
188 # Mark SSH to start immediately (but not right now)
189 touch /var
/ipfire
/remote
/enablessh
190 chown nobody
:nobody
/var
/ipfire
/remote
/enablessh
192 # Firewall rules for SSH and WEBIF
194 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
195 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
196 ) >> /var
/ipfire
/firewall
/input
198 # This script has now completed the first steps of setup
199 touch /var
/ipfire
/main
/firstsetup_ok
208 # Bring up the interface
209 ip link
set "${interface}" up
212 BOUND|RENEW|REBIND|REBOOT
)
213 # Remove any previous IP addresses
214 ip addr flush dev
"${interface}"
216 # Add (or re-add) the new IP address
217 ip addr add
"${new_ip_address}/${new_subnet_mask}" dev "${interface}"
219 # Add the default route
220 ip route add default via
"${new_routers}"
223 for domain_name_server
in ${new_domain_name_servers}; do
224 echo "nameserver ${domain_name_server}"
225 done > /etc
/resolv.conf
227 # The system is online now
228 touch /var
/ipfire
/red
/active
230 # Import Exoscale configuration
231 import_exoscale_configuration
234 EXPIRE|FAIL|RELEASE|STOP
)
235 # The system is no longer online
236 rm -f /var
/ipfire
/red
/active
238 # Remove all IP addresses
239 ip addr flush dev
"${interface}"
241 # Shut down the interface
242 ip link
set "${interface}" down
246 echo "Unhandled reason: ${reason}" >&2