6 # Set PATH to find our own executables
7 export PATH
=/usr
/local
/sbin
:/usr
/local
/bin
:${PATH}
9 # Exoscale only supports a MTU of 1500
15 wget
-qO - "http://metadata.exoscale.com/latest/${file}"
18 import_exoscale_configuration
() {
19 local instance_id
="$(get meta-data/instance-id)"
21 boot_mesg
"Importing Exoscale configuration for instance ${instance_id}..."
24 echo "${instance_id}" > /var
/run
/exoscale-instance-id
26 # Initialise system settings
27 local hostname
=$
(get meta-data
/local-hostname
)
30 if ! grep -q "^HOSTNAME=" /var
/ipfire
/main
/settings
; then
31 echo "HOSTNAME=${hostname%%.*}" >> /var
/ipfire
/main
/settings
35 if ! grep -q "^DOMAINNAME=" /var
/ipfire
/main
/settings
; then
36 local domainname
="localdomain"
38 # If the hostname contains a dot we strip the last
39 # part and use it as our domain name
40 if [[ ${hostname} =~
"\." ]]; then
41 domainname
="${hostname#*.}"
44 echo "DOMAINNAME=${domainname}" >> /var
/ipfire
/main
/settings
48 if ! getent passwd setup
&>/dev
/null
; then
49 useradd setup
-s /usr
/bin
/run-setup
-g nobody
-m
55 # Import SSH key for setup user
56 local key
=$
(get
"meta-data/public-keys")
57 if [ -n "${key}" ] && ! grep -q "^${key}$" "/home/setup/.ssh/authorized_keys" 2>/dev
/null
; then
58 mkdir
-p "/home/setup/.ssh"
59 chmod 700 "/home/setup/.ssh"
60 chown setup.nobody
"/home/setup/.ssh"
62 echo "${key}" >> "/home/setup/.ssh/authorized_keys"
63 chmod 600 "/home/setup/.ssh/authorized_keys"
64 chown setup.nobody
"/home/setup/.ssh/authorized_keys"
67 # Download the user-data script only on the first boot
68 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
70 local user_data
="$(get user-data)"
72 # Save user-data script to be executed later
73 if [ "${user_data:0:2}" = "#!" ]; then
74 echo "${user_data}" > /tmp
/user-data.
script
75 chmod 700 /tmp
/user-data.
script
77 # Run the user-data script
78 local now
="$(date -u +"%s
")"
79 /tmp
/user-data.
script &>/var
/log
/user-data.log.
${now}
81 # Delete the script right away
82 rm /tmp
/user-data.
script
86 # Import any previous settings for the local interfaces
87 eval $
(/usr
/local
/bin
/readhash
<(grep -E "^(GREEN|ORANGE)_.*=" /var
/ipfire
/ethernet
/settings
2>/dev
/null
))
89 # Import network configuration
90 # After this, no network connectivity will be available from this script due to the
91 # renaming of the network interfaces for which they have to be shut down
93 : > /var
/ipfire
/ethernet
/settings
96 for device
in /sys
/class
/net
/*; do
97 # Fetch the interface index
98 local ifindex
="$(<${device}/ifindex)"
99 local address
="$(<${device}/address)"
107 # The first interface will always be the public-facing one (i.e. RED)
112 echo "RED_MACADDR=${address}"
113 echo "RED_DESCRIPTION='${ifindex}'"
115 ) >> /var
/ipfire
/ethernet
/settings
120 # Set some sensible defaults for GREEN
121 if [ -z "${GREEN_ADDRESS}" ]; then
122 GREEN_ADDRESS
="10.0.0.1"
123 GREEN_NETMASK
="255.255.255.0"
124 GREEN_NETADDRESS
="10.0.0.0"
125 GREEN_BROADCAST
="10.0.0.255"
129 echo "GREEN_DEV=green0"
130 echo "GREEN_MACADDR=${address}"
131 echo "GREEN_DESCRIPTION='${ifindex}'"
132 echo "GREEN_ADDRESS=${GREEN_ADDRESS}"
133 echo "GREEN_NETMASK=${GREEN_NETMASK}"
134 echo "GREEN_NETADDRESS=${GREEN_NETADDRESS}"
135 echo "GREEN_BROADCAST=${GREEN_BROADCAST}"
136 echo "GREEN_MTU=${DEFAULT_MTU}"
137 ) >> /var
/ipfire
/ethernet
/settings
144 # Set some sensible defaults for ORANGE
145 if [ -z "${ORANGE_ADDRESS}" ]; then
146 ORANGE_ADDRESS
="10.0.1.1"
147 ORANGE_NETMASK
="255.255.255.0"
148 ORANGE_NETADDRESS
="10.0.1.0"
149 ORANGE_BROADCAST
="10.0.1.255"
153 echo "ORANGE_DEV=orange0"
154 echo "ORANGE_MACADDR=${address}"
155 echo "ORANGE_DESCRIPTION='${ifindex}'"
156 echo "ORANGE_ADDRESS=${ORANGE_ADDRESS}"
157 echo "ORANGE_NETMASK=${ORANGE_NETMASK}"
158 echo "ORANGE_NETADDRESS=${ORANGE_NETADDRESS}"
159 echo "ORANGE_BROADCAST=${ORANGE_BROADCAST}"
160 echo "ORANGE_MTU=${DEFAULT_MTU}"
161 ) >> /var
/ipfire
/ethernet
/settings
167 echo "CONFIG_TYPE=${config_type}" >> /var
/ipfire
/ethernet
/settings
169 # Actions performed only on the very first start
170 if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
171 # Disable using ISP nameservers
172 sed -e "s/^USE_ISP_NAMESERVERS=.*/USE_ISP_NAMESERVERS=off/" -i /var
/ipfire
/dns
/settings
175 sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var
/ipfire
/remote
/settings
177 # Disable SSH password authentication
178 sed -e "s/^ENABLE_SSH_PASSWORDS=.*/ENABLE_SSH_PASSWORDS=off/" -i /var
/ipfire
/remote
/settings
180 # Enable SSH key authentication
181 sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var
/ipfire
/remote
/settings
184 /usr
/local
/bin
/sshctrl
186 # Mark SSH to start immediately (but not right now)
187 touch /var
/ipfire
/remote
/enablessh
188 chown nobody
:nobody
/var
/ipfire
/remote
/enablessh
190 # Firewall rules for SSH and WEBIF
192 echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
193 echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
194 ) >> /var
/ipfire
/firewall
/input
196 # This script has now completed the first steps of setup
197 touch /var
/ipfire
/main
/firstsetup_ok
206 # Bring up the interface
207 ip link
set "${interface}" up
210 BOUND|RENEW|REBIND|REBOOT
)
211 # Remove any previous IP addresses
212 ip addr flush dev
"${interface}"
214 # Add (or re-add) the new IP address
215 ip addr add
"${new_ip_address}/${new_subnet_mask}" dev "${interface}"
217 # Add the default route
218 ip route add default via
"${new_routers}"
221 for domain_name_server
in ${new_domain_name_servers}; do
222 echo "nameserver ${domain_name_server}"
223 done > /etc
/resolv.conf
225 # The system is online now
226 touch /var
/ipfire
/red
/active
228 # Import Exoscale configuration
229 import_exoscale_configuration
232 EXPIRE|FAIL|RELEASE|STOP
)
233 # The system is no longer online
234 rm -f /var
/ipfire
/red
/active
236 # Remove all IP addresses
237 ip addr flush dev
"${interface}"
239 # Shut down the interface
240 ip link
set "${interface}" down
244 echo "Unhandled reason: ${reason}" >&2