6 # Set PATH to find our own executables
7 export PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:${PATH}
9 # Exoscale only supports a MTU of 1500
15 wget
-qO - "http://metadata.exoscale.com/latest/${file}"
18 import_exoscale_configuration
() {
19 local instance_id
="$(get meta-data/instance-id)"
21 boot_mesg
"Importing Exoscale configuration for instance ${instance_id}..."
24 echo "${instance_id}" > /var
/run
/exoscale-instance-id
26 # Initialise system settings
27 local hostname
=$
(get meta-data
/local-hostname
)
30 if ! grep -q "^HOSTNAME=" /var
/ipfire
/main
/settings
; then
31 echo "HOSTNAME=${hostname%%.*}" >> /var
/ipfire
/main
/settings
35 if ! grep -q "^DOMAINNAME=" /var
/ipfire
/main
/settings
; then
36 local domainname
="localdomain"
38 # If the hostname contains a dot we strip the last
39 # part and use it as our domain name
40 if [[ ${hostname} =~
"\." ]]; then
41 domainname
="${hostname#*.}"
44 echo "DOMAINNAME=${domainname}" >> /var
/ipfire
/main
/settings
48 if ! getent passwd setup
&>/dev
/null
; then
49 useradd setup
-s /usr
/bin
/run-setup
-g nobody
-m
55 # Import SSH key for setup user
56 local key
=$
(get
"meta-data/public-keys")
57 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev
/null
; then
58 mkdir
-p "/home/setup/.ssh"
59 chmod 700 "/home/setup/.ssh"
60 chown setup.nobody
"/home/setup/.ssh"
62 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
63 chmod 600 "/home/setup/.ssh/authorized_keys"
64 chown setup.nobody
"/home/setup/.ssh/authorized_keys"
67 # Download the user-data script only on the first boot
68 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
70 local user_data
="$(get user-data)"
72 # Save user-data script to be executed later
73 if [ "${user_data:0:2}" = "#!" ]; then
74 echo "${user_data}" > /tmp
/user-data.
script
75 chmod 700 /tmp
/user-data.
script
77 # Run the user-data script
78 local now
="$(date -u +"%s
")"
79 /tmp
/user-data.
script &>/var
/log
/user-data.log.
${now}
81 # Delete the script right away
82 rm /tmp
/user-data.
script
86 # Import any previous settings for the local interfaces
87 eval $
(/usr
/local
/bin
/readhash
<(grep -E "^(GREEN|ORANGE)_.*=" /var
/ipfire
/ethernet
/settings
2>/dev
/null
))
89 # Import network configuration
90 # After this, no network connectivity will be available from this script due to the
91 # renaming of the network interfaces for which they have to be shut down
93 : > /var
/ipfire
/ethernet
/settings
96 for device
in /sys
/class
/net
/*; do
97 # Fetch the interface index
98 local ifindex
="$(<${device}/ifindex)"
99 local address
="$(<${device}/address)"
107 # The first interface will always be the public-facing one (i.e. RED)
112 echo "RED_MACADDR=${address}"
113 echo "RED_DESCRIPTION='${ifindex}'"
115 ) >> /var
/ipfire
/ethernet
/settings
120 # Set some sensible defaults for GREEN
121 if [ -z "${GREEN_ADDRESS}" ]; then
122 GREEN_ADDRESS
="10.0.0.1"
123 GREEN_NETMASK
="255.255.255.0"
124 GREEN_NETADDRESS
="10.0.0.0"
128 echo "GREEN_DEV=green0"
129 echo "GREEN_MACADDR=${address}"
130 echo "GREEN_DESCRIPTION='${ifindex}'"
131 echo "GREEN_ADDRESS=${GREEN_ADDRESS}"
132 echo "GREEN_NETMASK=${GREEN_NETMASK}"
133 echo "GREEN_NETADDRESS=${GREEN_NETADDRESS}"
134 echo "GREEN_MTU=${DEFAULT_MTU}"
135 ) >> /var
/ipfire
/ethernet
/settings
142 # Set some sensible defaults for ORANGE
143 if [ -z "${ORANGE_ADDRESS}" ]; then
144 ORANGE_ADDRESS
="10.0.1.1"
145 ORANGE_NETMASK
="255.255.255.0"
146 ORANGE_NETADDRESS
="10.0.1.0"
150 echo "ORANGE_DEV=orange0"
151 echo "ORANGE_MACADDR=${address}"
152 echo "ORANGE_DESCRIPTION='${ifindex}'"
153 echo "ORANGE_ADDRESS=${ORANGE_ADDRESS}"
154 echo "ORANGE_NETMASK=${ORANGE_NETMASK}"
155 echo "ORANGE_NETADDRESS=${ORANGE_NETADDRESS}"
156 echo "ORANGE_MTU=${DEFAULT_MTU}"
157 ) >> /var
/ipfire
/ethernet
/settings
163 echo "CONFIG_TYPE=${config_type}" >> /var
/ipfire
/ethernet
/settings
165 # Actions performed only on the very first start
166 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
167 # Disable using ISP nameservers
168 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var
/ipfire
/dns
/settings
171 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var
/ipfire
/remote
/settings
173 # Disable SSH password authentication
174 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var
/ipfire
/remote
/settings
176 # Enable SSH key authentication
177 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var
/ipfire
/remote
/settings
180 /usr
/local
/bin
/sshctrl
182 # Mark SSH to start immediately (but not right now)
183 touch /var
/ipfire
/remote
/enablessh
184 chown nobody
:nobody
/var
/ipfire
/remote
/enablessh
186 # Firewall rules for SSH and WEBIF
188 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
189 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
190 ) >> /var
/ipfire
/firewall
/input
192 # This script has now completed the first steps of setup
193 touch /var
/ipfire
/main
/firstsetup_ok
202 # Bring up the interface
203 ip link
set "${interface}" up
206 BOUND|RENEW|REBIND|REBOOT
)
207 # Remove any previous IP addresses
208 ip addr flush dev
"${interface}"
210 # Add (or re-add) the new IP address
211 ip addr add
"${new_ip_address}/${new_subnet_mask}" dev "${interface}"
213 # Add the default route
214 ip route add default via
"${new_routers}"
217 for domain_name_server
in ${new_domain_name_servers}; do
218 echo "nameserver ${domain_name_server}"
219 done > /etc
/resolv.conf
221 # The system is online now
222 touch /var
/ipfire
/red
/active
224 # Import Exoscale configuration
225 import_exoscale_configuration
228 EXPIRE|FAIL|RELEASE|STOP
)
229 # The system is no longer online
230 rm -f /var
/ipfire
/red
/active
232 # Remove all IP addresses
233 ip addr flush dev
"${interface}"
235 # Shut down the interface
236 ip link
set "${interface}" down
240 echo "Unhandled reason: ${reason}" >&2