$(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$0")
ENVIRONMENT:
TRACE # affiche les commandes avant leur exécution
- $(sed -ne 's/^readonly \([^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
+ $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
EOF
}
readonly vm_dev_disk="/dev/xvda"
readonly vm_dev_disk_boot="${vm_dev_disk}1"
-readonly vm_dev_disk_swap="${vm_dev_disk}5"
-readonly vm_dev_disk_root="${vm_dev_disk}6"
-readonly vm_dev_disk_var="${vm_dev_disk}7"
-readonly vm_dev_disk_home="${vm_dev_disk}8"
rule_xen_config_init () {
sudo tee /etc/xen/$vm_fqdn.cfg <<-EOF
}
rule_disk_mount () { # DESCRIPTION: montage du disque de la VM depuis l'hôte
- test -e $vm_dev_disk ||
sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
# NOTE: on pourrait utiliser kpartx à la place je pense ; détail.
}
rule_disk_umount () { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
- mountpoint /mnt/$vm_fqdn ||
+ rule_part_boot_umount
+ case $vm_use_lvm in
+ (yes)
+ rule_part_lvm_umount
+ ;;
+ (no)
+ rule_part_root_umount
+ rule_part_var_umount
+ rule_part_home_umount
+ ;;
+ (*) exit 1;;
+ esac
sudo xm block-detach 0 $vm_dev_disk
}
-rule_disk_part () { # DESCRIPTION: partitionage du disque de la VM
- # NOTE: on fait le choix de ne pas utiliser LVM sur la machine virtuelle car :
- # - pour l'extension de mémoire:
- # 1. on créera une nouvelle partition sur le LVM de l'hôte
- # 2. on l'ajoutera comme un disque supplémentaire dans /etc/xen/$vm_fqdn.cfg
- # 3. on le montera sur /home2 en pensant à changer DHOME=/home2 dans /etc/adduser.conf
- # - pour la sauvegarde: LVM snapshoot est trop
- # 1. sauvegarde au niveau applicatif (pgdump, mysqldump)
- # 2. sauvegarde des configurations (etckeeper, git)
- # 3. sauvegarde incrémentale et chiffrée des autres fichiers (duplicity)
- sudo sfdisk -d $vm_dev_disk <<-EOF
- # partition table of $vm_dev_disk
- unit: sectors
-
- ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
- ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
- ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
- ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
- ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
- ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
- ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
- ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
- EOF
+
+case $vm_use_lvm in
+(no)
+ readonly vm_dev_disk_swap="${vm_dev_disk}5"
+ readonly vm_dev_disk_root="${vm_dev_disk}6"
+ readonly vm_dev_disk_var="${vm_dev_disk}7"
+ readonly vm_dev_disk_home="${vm_dev_disk}8"
+ ;;
+(yes)
+ readonly vm_lvm_pv="${vm_dev_disk}2"
+ readonly vm_lvm_vg=$vm
+ readonly vm_lvm_dev=$(printf %s $vm_lvm_vg | sed -e 's/-/--/g')
+ readonly vm_lvm_lv=$vm
+ readonly vm_dev_disk_swap=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_swap
+ readonly vm_dev_disk_root=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_root
+ readonly vm_dev_disk_var=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}_var
+ readonly vm_dev_disk_home=/dev/mapper/$vm_lvm_dev-${vm_lvm_lv}home
+ ;;
+(*)
+ exit 1;;
+ esac
+
+rule_disk_format () { # DESCRIPTION: partitionnage du disque de la VM
+ case $vm_use_lvm in
+ (no)
+ sudo sfdisk $vm_dev_disk <<-EOF
+ # partition table of $vm_dev_disk
+ unit: sectors
+
+ ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
+ ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
+ ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
+ ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
+ ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
+ ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
+ ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
+ ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
+ EOF
+ ;;
+ (yes)
+ sudo sfdisk $vm_dev_disk <<-EOF
+ # partition table of $vm_dev_disk
+ unit: sectors
+
+ ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
+ ${vm_dev_disk}2 : start= 498015, size=418927005, Id=8E
+ EOF
+ ;;
+ (*) exit 1;;
+ esac
+ sudo partprobe $vm_dev_disk
+ }
+
+rule_part_lvm_format () {
+ rule_part_lvm_umount
+ ! sudo vgs | grep -q "^ $vm_lvm_vg " ||
+ sudo vgremove $vm_lvm_vg
+ sudo pvcreate --dataalignment 512k $vm_lvm_pv
+ sudo vgcreate --dataalignment 512k $vm_lvm_vg $vm_lvm_pv
+ sudo lvcreate --contiguous y -n ${vm_lvm_lv}_swap -L 1G $vm_lvm_vg
+ sudo lvcreate --contiguous y -n ${vm_lvm_lv}_root -L 15G $vm_lvm_vg
+ sudo lvcreate --contiguous y -n ${vm_lvm_lv}_var -L 5G $vm_lvm_vg
+ sudo lvcreate --contiguous y -n ${vm_lvm_lv}_home -l 99%FREE $vm_lvm_vg
+ rule_part_lvm_umount
+ }
+rule_part_lvm_mount () {
+ sudo vgchange -a y $vm_lvm_vg
+ sudo lvchange -a y $vm_lvm_lv
+ }
+rule_part_lvm_umount () {
+ rule_part_root_umount
+ rule_part_var_umount
+ rule_part_home_umount
+ if sudo vgs | grep -q "^ $vm_lvm_vg "
+ then
+ sudo lvchange -a n $vm_lvm_vg
+ sudo vgchange -a n $vm_lvm_vg
+ fi
}
rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
test ! -e /dev/mapper/${vm}_${part}_deciphered ||
sudo cryptsetup luksClose ${vm}_${part}_deciphered
}
+
rule_part_root_format () {
if ! mount | grep -q "^$vm_dev_disk_root "
then
sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
--cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm}_root_deciphered
- sudo mkfs.ext4 -m 5 -T ext4 -L ${vm}_root -E stripe_width=32,resize=15G \
+ sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
+ -E resize=15G${vm_e2fs_extended_options} \
+ -L ${vm}_root \
/dev/mapper/${vm}_root_deciphered
- ! mountpoint /mnt/$vm_fqdn
+ ! mountpoint -q /mnt/$vm_fqdn
sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/boot
mk_dir mod=0770 own=root:root /mnt/$vm_fqdn/dev
rule_part_root_mount () {
test -e /dev/mapper/${vm}_root_deciphered ||
sudo cryptsetup luksOpen $vm_dev_disk_root ${vm}_root_deciphered
- ! mountpoint /mnt/$vm_fqdn ||
+ ! mountpoint -q /mnt/$vm_fqdn ||
sudo mount -v /dev/mapper/${vm}_root_deciphered /mnt/$vm_fqdn
}
rule_part_root_umount () {
- ! mountpoint /mnt/$vm_fqdn ||
- sudo umount -v /mnt/$vm_fqdn
+ ! mountpoint -q /mnt/$vm_fqdn ||
+ sudo umount -v /mnt/$vm_fqdn
! test -e /dev/mapper/${vm}_root_deciphered ||
sudo cryptsetup luksClose ${vm}_root_deciphered
}
}
rule_part_boot_format () {
mount | grep -q "^$vm_dev_disk_boot " ||
- sudo mkfs.ext2 -m 0 -T small -L ${vm}_boot $vm_dev_disk_boot
+ sudo mke2fs -t ext2 -c -c -m 5 -T small \
+ -E resize=1G${vm_e2fs_extended_options} \
+ -L ${vm}_boot $vm_dev_disk_boot
}
rule_part_boot_mount () {
- mountpoint /mnt/$vm_fqdn
+ mountpoint -q /mnt/$vm_fqdn
test -d /mnt/$vm_fqdn/boot
- mountpoint /mnt/$vm_fqdn/boot ||
+ mountpoint -q /mnt/$vm_fqdn/boot ||
sudo mount -v $vm_dev_disk_boot /mnt/$vm_fqdn/boot
}
rule_part_boot_umount () {
- ! mountpoint /mnt/$vm_fqdn/boot ||
- sudo umount -v /mnt/$vm_fqdn/boot
+ ! mountpoint -q /mnt/$vm_fqdn/boot ||
+ sudo umount -v /mnt/$vm_fqdn/boot
}
rule_part_var_format () {
rule__part_encrypted_format var
rule__part_encrypted_mount var
- sudo mkfs.ext4 -m 5 -T ext4 -L ${vm}_var -E stripe_width=32,resize=5G \
- /dev/mapper/${vm}_${part}_deciphered
+ sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
+ -E resize=10G${vm_e2fs_extended_options} \
+ -L ${vm}_var \
+ /dev/mapper/${vm}_var_deciphered
rule__part_encrypted_umount var
}
rule_part_var_mount () {
- rule__part_encrypted_mount var
- mountpoint /mnt/$vm_fqdn/var ||
+ rule__part_encrypted_mount var
+ mountpoint -q /mnt/$vm_fqdn/var ||
sudo mount -v /dev/mapper/${vm}_var_deciphered /mnt/$vm_fqdn/var
}
rule_part_var_umount () {
- ! mountpoint /mnt/$vm_fqdn/var ||
- sudo umount -v /mnt/$vm_fqdn/var
+ ! mountpoint -q /mnt/$vm_fqdn/var ||
+ sudo umount -v /mnt/$vm_fqdn/var
rule__part_encrypted_umount var
}
rule_part_home_format () {
rule__part_encrypted_format home
rule__part_encrypted_mount home
- sudo mkfs.ext4 -m 0 -T ext4 -L ${vm}_home -E stripe_width=32,resize=200G \
+ sudo mke2fs -t ext4 -c -c -m 0 -T ext4 -b $vm_e2fs_block_size \
+ -E resize=400G${vm_e2fs_extended_options} \
+ -O quota \
+ -L ${vm}_home \
/dev/mapper/${vm}_home_deciphered
rule__part_encrypted_umount home
}
rule_part_home_mount () {
rule__part_encrypted_mount home
- mountpoint /mnt/$vm_fqdn/home ||
+ mountpoint -q /mnt/$vm_fqdn/home ||
sudo mount -v /dev/mapper/${vm}_home_deciphered /mnt/$vm_fqdn/home
}
rule_part_home_umount () {
- ! mountpoint /mnt/$vm_fqdn/home ||
- sudo umount -v /mnt/$vm_fqdn/home
+ ! mountpoint -q /mnt/$vm_fqdn/home ||
+ sudo umount -v /mnt/$vm_fqdn/home
rule__part_encrypted_umount home
}
rule_part_root_mount
rule_part_var_mount
#rule_part_home_mount
- mountpoint /mnt/$vm_fqdn/proc ||
+ mountpoint -q /mnt/$vm_fqdn/proc ||
mount -t proc proc /mnt/$vm_fqdn/proc
- mountpoint /mnt/$vm_fqdn/sys ||
+ mountpoint -q /mnt/$vm_fqdn/sys ||
mount -t sysfs sys /mnt/$vm_fqdn/sys
- mountpoint /mnt/$vm_fqdn/dev ||
+ mountpoint -q /mnt/$vm_fqdn/dev ||
mount --bind /dev /mnt/$vm_fqdn/dev
sudo chroot /mnt/$vm_fqdn /bin/bash || true
rule__chroot_clean
readonly PATH=$PATH:/usr/sbin:/sbin
readonly vm="ateliers"
+readonly vm_fqdn="$vm.heureux-cyclage.org"
+
+readonly vm_use_lvm="yes"
+ # - sans LVM :
+ # - on a accès au LVM de l'hôte, mais c'est pas très propre.
+ # - pour l'extension de mémoire, on peut soit :
+ # 1.1. étendre avec lvresize /dev/domU/$vm_fqdn-disk
+ # 1.2. étendre avec sfdisk $vm_dev_disk_home
+ # 1.3. étendre avec resize2fs /dev/mapper/${vm}_home_deciphered
+ # soit :
+ # 2.1. créer une nouvelle partition sur le LVM de l'hôte
+ # 2.2. l'ajouter comme un disque supplémentaire dans /etc/xen/$vm_fqdn.cfg
+ # 2.3. le monter sur /home2 en pensant à changer DHOME=/home2 dans /etc/adduser.conf
+ # - pour la sauvegarde: on peut soit :
+ # 1. sauvegarder au niveau applicatif (pgdump, mysqldump, etckeeper, git)
+ # 2. sauvegarder incrémentalement avec (duplicity, backup-ninja, BackupPC),
+ # depuis l'hôte pour avoir un snapshot LVM.
+ # - avec LVM :
+ # - question ouverte de la performance du LVM dans du LVM.
+ # - pour l'extension de mémoire, on peut soit :
+ # 1.1. étendre avec lvresize /dev/domU/$vm_fqdn-disk
+ # 1.1. étendre avec pvextend $vm_lvm_pv
+ # 1.1. étendre avec lvresize /dev/mapper/${vm}_home_deciphered
+ # 1.3. étendre avec resize2fs /dev/mapper/${vm}_home_deciphered
+ # - pour la sauvegarde: on peut soit :
+ # 1. sauvegarder au niveau applicatif (pgdump, mysqldump, etckeeper, git)
+ # 2. sauvegarder incrémentalement avec (duplicity, backup-ninja, BackupPC),
+ # depuis la VM pour avoir un snapshot LVM.
+
+# Cartographie de la mémoire morte :
+# SATA2 * 2 (/dev/sd{a,b})
+# /dev/sda -> /dev/sda{1,2,3}
+# /dev/sdb -> /dev/sdb{1,2,3}
+# RAID1 logiciel
+# /dev/sd{a,b}1 -> /dev/md0
+# /dev/sd{a,b}2 -> /dev/md1
+# /dev/sd{a,b}3 -> /dev/md2
+# LVM
+# /dev/md0 -> dom0
+# /dev/md2 -> domU -> /dev/mapper/$vm_fqdn-disk
+# LVM
+# /dev/mapper/$vm_fqdn-disk -> /dev/xvda{1,2}
+# /dev/xvda2 -> /dev/mapper/${vm_lvm_vg}-${vm_lvm_lv}_{swap,root,var,home}
+
+readonly vm_raid_effective_disks=1 # NOTE: RAID1 (mirroring)
+ # NOTE: julm@rouf:~$ sudo pvs /dev/md2 -o+pe_start
+ # PV VG Fmt Attr PSize PFree 1st PE
+ # /dev/md2 domU lvm2 a- 925,64g 470,64g 192,00k <- pas adapté au TRIM SSD, mais on utilise du SATA2
+readonly vm_e2fs_block_size=4096
+ # NOTE: valeur standard pour un disque avec des secteurs de 512 octets :
+ # julm@rouf:~$ grep . /sys/block/sd{a,b}/queue/*_block_size
+ # /sys/block/sda/queue/logical_block_size:512
+ # /sys/block/sda/queue/physical_block_size:512
+ # /sys/block/sdb/queue/logical_block_size:512
+ # /sys/block/sdb/queue/physical_block_size:512
+readonly vm_e2fs_stripe_size=
+ # NOTE: égal au chunk size de mdadm --detail ;
+ # mais ne concerne pas RAID1 où il n'y a pas de changement de disque à effectuer,
+ # et donc pas de chunk size.
+readonly vm_e2fs_stride=${vm_e2fs_stripe_size:+$((vm_e2fs_stripe_size / vm_e2fs_block_size))}
+readonly vm_e2fs_stripe_width=${vm_e2fs_stride:+$((vm_e2fs_stride * vm_raid_effective_disks))}
+ vm_e2fs_extended_options=${vm_e2fs_stride:+,stride=$vm_e2fs_stride}${vm_e2fs_stripe_width:+,stripe_width=$vm_e2fs_stripe_width}
+
readonly vm_arch="amd64"
readonly vm_bridge="br-gresille"
-readonly vm_fqdn="$vm.heureux-cyclage.org"
readonly vm_ipv4="91.216.110.42" # NOTE: IPv4 publique assignée par Grésille
readonly vm_lsb_name="wheezy"
readonly vm_mac="00:16:3E:E5:98:42" # NOTE: addresse MAC assignée par Grésille