6 # Set PATH to find our own executables
7 export PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:${PATH}
9 # Exoscale only supports a MTU of 1500
15 wget
-qO - "http://metadata.exoscale.com/latest/${file}"
18 import_exoscale_configuration
() {
19 local instance_id
="$(get meta-data/instance-id)"
21 boot_mesg
"Importing Exoscale configuration for instance ${instance_id}..."
24 echo "${instance_id}" > /var
/run
/exoscale-instance-id
26 # Initialise system settings
27 local hostname
=$
(get meta-data
/local-hostname
)
30 if ! grep -q "^HOSTNAME=" /var
/ipfire
/main
/settings
; then
31 echo "HOSTNAME=${hostname%%.*}" >> /var
/ipfire
/main
/settings
35 if ! grep -q "^DOMAINNAME=" /var
/ipfire
/main
/settings
; then
36 local domainname
="${hostname#*.}"
38 # Fall back to localdomain
39 [ -z "${domainname}" ] && domainname
="localdomain"
41 echo "DOMAINNAME=${domainname}" >> /var
/ipfire
/main
/settings
45 if ! getent passwd setup
&>/dev
/null
; then
46 useradd setup
-s /usr
/bin
/run-setup
-g nobody
-m
52 # Import SSH key for setup user
53 local key
=$
(get
"meta-data/public-keys")
54 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev
/null
; then
55 mkdir
-p "/home/setup/.ssh"
56 chmod 700 "/home/setup/.ssh"
57 chown setup.nobody
"/home/setup/.ssh"
59 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
60 chmod 600 "/home/setup/.ssh/authorized_keys"
61 chown setup.nobody
"/home/setup/.ssh/authorized_keys"
64 # Download the user-data script only on the first boot
65 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
67 local user_data
="$(get user-data)"
69 # Save user-data script to be executed later
70 if [ "${user_data:0:2}" = "#!" ]; then
71 echo "${user_data}" > /tmp
/user-data.
script
72 chmod 700 /tmp
/user-data.
script
74 # Run the user-data script
75 local now
="$(date -u +"%s
")"
76 /tmp
/user-data.
script &>/var
/log
/user-data.log.
${now}
78 # Delete the script right away
79 rm /tmp
/user-data.
script
83 # Import any previous settings for the local interfaces
84 eval $
(/usr
/local
/bin
/readhash
<(grep -E "^(GREEN|ORANGE)_.*=" /var
/ipfire
/ethernet
/settings
2>/dev
/null
))
86 # Import network configuration
87 # After this, no network connectivity will be available from this script due to the
88 # renaming of the network interfaces for which they have to be shut down
90 : > /var
/ipfire
/ethernet
/settings
93 for device
in /sys
/class
/net
/*; do
94 # Fetch the interface index
95 local ifindex
="$(<${device}/ifindex)"
96 local address
="$(<${device}/address)"
104 # The first interface will always be the public-facing one (i.e. RED)
109 echo "RED_MACADDR=${address}"
110 echo "RED_DESCRIPTION='${ifindex}'"
112 ) >> /var
/ipfire
/ethernet
/settings
117 # Set some sensible defaults for GREEN
118 if [ -z "${GREEN_ADDRESS}" ]; then
119 GREEN_ADDRESS
="10.0.0.1"
120 GREEN_NETMASK
="255.255.255.0"
121 GREEN_NETADDRESS
="10.0.0.0"
122 GREEN_BROADCAST
="10.0.0.255"
126 echo "GREEN_DEV=green0"
127 echo "GREEN_MACADDR=${address}"
128 echo "GREEN_DESCRIPTION='${ifindex}'"
129 echo "GREEN_ADDRESS=${GREEN_ADDRESS}"
130 echo "GREEN_NETMASK=${GREEN_NETMASK}"
131 echo "GREEN_NETADDRESS=${GREEN_NETADDRESS}"
132 echo "GREEN_BROADCAST=${GREEN_BROADCAST}"
133 echo "GREEN_MTU=${DEFAULT_MTU}"
134 ) >> /var
/ipfire
/ethernet
/settings
141 # Set some sensible defaults for ORANGE
142 if [ -z "${ORANGE_ADDRESS}" ]; then
143 ORANGE_ADDRESS
="10.0.1.1"
144 ORANGE_NETMASK
="255.255.255.0"
145 ORANGE_NETADDRESS
="10.0.1.0"
146 ORANGE_BROADCAST
="10.0.1.255"
150 echo "ORANGE_DEV=orange0"
151 echo "ORANGE_MACADDR=${address}"
152 echo "ORANGE_DESCRIPTION='${ifindex}'"
153 echo "ORANGE_ADDRESS=${ORANGE_ADDRESS}"
154 echo "ORANGE_NETMASK=${ORANGE_NETMASK}"
155 echo "ORANGE_NETADDRESS=${ORANGE_NETADDRESS}"
156 echo "ORANGE_BROADCAST=${ORANGE_BROADCAST}"
157 echo "ORANGE_MTU=${DEFAULT_MTU}"
158 ) >> /var
/ipfire
/ethernet
/settings
164 echo "CONFIG_TYPE=${config_type}" >> /var
/ipfire
/ethernet
/settings
166 # Actions performed only on the very first start
167 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
168 # Disable using ISP nameservers
169 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var
/ipfire
/dns
/settings
172 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var
/ipfire
/remote
/settings
174 # Disable SSH password authentication
175 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var
/ipfire
/remote
/settings
177 # Enable SSH key authentication
178 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var
/ipfire
/remote
/settings
181 /usr
/local
/bin
/sshctrl
183 # Mark SSH to start immediately (but not right now)
184 touch /var
/ipfire
/remote
/enablessh
185 chown nobody
:nobody
/var
/ipfire
/remote
/enablessh
187 # Firewall rules for SSH and WEBIF
189 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
190 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
191 ) >> /var
/ipfire
/firewall
/input
193 # This script has now completed the first steps of setup
194 touch /var
/ipfire
/main
/firstsetup_ok
203 # Bring up the interface
204 ip link
set "${interface}" up
207 BOUND|RENEW|REBIND|REBOOT
)
208 # Remove any previous IP addresses
209 ip addr flush dev
"${interface}"
211 # Add (or re-add) the new IP address
212 ip addr add
"${new_ip_address}/${new_subnet_mask}" dev "${interface}"
214 # Add the default route
215 ip route add default via
"${new_routers}"
218 for domain_name_server
in ${new_domain_name_servers}; do
219 echo "nameserver ${domain_name_server}"
220 done > /etc
/resolv.conf
222 # The system is online now
223 touch /var
/ipfire
/red
/active
225 # Import Exoscale configuration
226 import_exoscale_configuration
229 EXPIRE|FAIL|RELEASE|STOP
)
230 # The system is no longer online
231 rm -f /var
/ipfire
/red
/active
233 # Remove all IP addresses
234 ip addr flush dev
"${interface}"
236 # Shut down the interface
237 ip link
set "${interface}" down
241 echo "Unhandled reason: ${reason}" >&2