remove the trust entry before finishing to preserve security of system.
[plcrt.git] / plcrt.init
1 #!/bin/bash
2 #
3 # priority: 850
4 #
5 # Manage settings for the RT installtion 
6 #
7 # Stephen Soltesz <soltesz@cs.princeton.edu>
8 # Copyright (C) 2008 The Trustees of Princeton University
9 #
10 # $Id$
11 #
12
13 # Source function library and configuration
14 . /etc/plc.d/functions
15 . /etc/planetlab/plc_config
16 local_config=/etc/planetlab/configs/site.xml
17
18 PLCRTPATH=/usr/share/plcrt
19
20 # Be verbose
21 set -x
22
23 # Default locations
24 PGDATA=/var/lib/pgsql/data
25 postgresql_conf=$PGDATA/postgresql.conf
26 pghba_conf=$PGDATA/pg_hba.conf
27
28 # Export so that we do not have to specify -p to psql invocations
29 export PGPORT=$PLC_DB_PORT
30
31
32 RT3_DB_USER="rt3user"
33 RT3_DB_NAME="rt3"
34
35 WROTE_PG_CONFIG=
36
37 if [ -z "$PLC_RT_IP" ] ; then
38         PLC_RT_IP=$( gethostbyname $PLC_RT_HOST )
39 fi
40
41 # NOTE: code duplicated from monitor.functions to allow package to be separate
42 #               from it.
43 function check_pg_hba ()
44 {
45         NAME=$1
46         USER=$2
47         #### SETUP ACCESS to this user and database
48         mkdir -p $PGDATA/pg_hba.conf.d
49         CONF=$PGDATA/pg_hba.conf.d/${NAME}.conf
50         if [ ! -f $CONF ] ; then
51                 echo "host $NAME $USER 127.0.0.1/32 password"   > $CONF
52                 echo "host $NAME $USER $PLC_RT_IP/32 password" >> $CONF
53
54                 WROTE_PG_CONFIG="true"
55         fi
56 }
57
58 # TODO: make values re-configurable...  this may be an issue with RT's db, though.
59 function update_config ()
60 {
61         pattern=$1
62         with=$2
63         file=$3
64         sed -i -e "s/$pattern/$with/g" $file
65 }
66
67 function check_rt_siteconfig ()
68 {
69         tmp_siteconfig=$(mktemp)
70         tmp_initialdata=$(mktemp)
71
72         # TODO: need a better approach for this.
73         for f in $PLCRTPATH/conf.d/*.pl ; do 
74                 update_config PLC_RT_HOSTNAME $PLC_RT_HOST $f
75         done
76
77         # TODO: need a better approach for this.
78         if [ -f /etc/httpd/conf.d/rt3.conf ] ; then
79                 update_config PLC_RT_HOST $PLC_RT_HOST /etc/httpd/conf.d/rt3.conf
80         fi
81         
82         # if the templates are newer than the actual config, then replace them.
83         if [ $PLCRTPATH/RT_SiteConfig.pm -nt /etc/rt3/RT_SiteConfig.pm ] ;
84         then
85                 # copy templates
86                 cp -f $PLCRTPATH/RT_SiteConfig.pm $tmp_siteconfig
87                 cp -f $PLCRTPATH/initialdata $tmp_initialdata
88
89                 # setup RT_SiteConfig.pm
90                 update_config PLC_NAME "$PLC_NAME" $tmp_siteconfig
91                 update_config PLC_RT_HOSTNAME $PLC_RT_HOST $tmp_siteconfig
92                 update_config PLC_WWW_HOSTNAME $PLC_WWW_HOST $tmp_siteconfig
93
94                 update_config RT_DB_NAME $RT3_DB_NAME $tmp_siteconfig
95                 update_config RT_DB_USER $RT3_DB_USER $tmp_siteconfig
96                 update_config RT_DB_PASSWORD $PLC_MONITOR_DBPASSWORD $tmp_siteconfig
97
98                 # setup initialdata
99                 update_config PLC_RT_HOSTNAME $PLC_RT_HOST $tmp_initialdata
100
101                 # copy to live configuration
102                 cp -f $tmp_siteconfig /etc/rt3/RT_SiteConfig.pm 
103                 cp -f $tmp_initialdata /etc/rt3/initialdata 
104                 chmod 644 /etc/rt3/RT_SiteConfig.pm 
105                 chmod 644 /etc/rt3/initialdata 
106
107                 rm -f $tmp_siteconfig
108                 rm -f $tmp_initialdata
109         fi
110 }
111
112 function check_rt_custom ()
113 {
114         rsync -qv -az $PLCRTPATH/local/html /usr/share/rt3
115 }
116
117 function check_rt_pghba ()
118 {
119         NAME=$RT3_DB_NAME
120         USER=$RT3_DB_USER
121         CONF=$PGDATA/pg_hba.conf.d/${NAME}.conf
122         PATTERN="host all postgres 127.0.0.1/32 trust"
123         PATTERN="host all postgres $PLC_RT_IP/32 trust"
124
125         if ! grep -q "$PATTERN" $CONF ; then
126                 #### SETUP ACCESS from postgres user to run init for the first time.
127                 echo "$PATTERN" >> $CONF
128                 WROTE_PG_CONFIG="true"
129         fi
130
131 }
132
133 function check_rt_aliases ()
134 {
135
136         if ! grep -q "rt-mailgate --queue support" /etc/aliases ; 
137         then 
138                 sed -i -e "s/^support.*postmaster//g" /etc/aliases
139                 sed -i -e "s/^security.*root//g" /etc/aliases
140         cat <<EOF >> /etc/aliases
141 # added by RT init scripts for default queues.
142 support: "|/usr/sbin/rt-mailgate --queue support --action correspond --url http://localhost/rt3/"
143 monitor: "|/usr/sbin/rt-mailgate --queue monitor --action correspond --url http://localhost/rt3/"
144 security: "|/usr/sbin/rt-mailgate --queue security --action correspond --url http://localhost/rt3/"
145 legal: "|/usr/sbin/rt-mailgate --queue legal --action correspond --url http://localhost/rt3/"
146 EOF
147                 /usr/bin/newaliases
148         fi
149
150 }
151
152 function check_rt_init ()
153 {
154         if [ ! -f /etc/rt3/setup.finished ] ; then
155                 /usr/sbin/rt-setup-database --action init --dba postgres
156                 for f in $PLCRTPATH/conf.d/*.pl ; do 
157                         /usr/sbin/rt-setup-database --action insert --dba postgres --datafile $f
158                 done
159
160                 # run initial setup scripts (run only once, or for the first time)
161                 if [ -d $PLCRTPATH/setup.d ] ; then 
162                         for f in $PLCRTPATH/setup.d/*.{pl,py,sh} ; do 
163                                 $f
164                         done
165                 fi
166
167                 touch /etc/rt3/setup.finished
168
169         fi
170 }
171
172 check_rt_sendmail ()
173 {
174         tmp_sendmailmc=$(mktemp)
175         
176         # if the templates is newer than the processed config, then update it
177         if grep -q "Addr=127.0.0.1," /etc/mail/sendmail.mc  ; 
178         then
179                 # copy templates
180                 cp -f /etc/mail/sendmail.mc $tmp_sendmailmc
181
182                 # setup initialdata
183                 update_config "Addr=127.0.0.1," "" $tmp_sendmailmc
184
185                 # copy to live configuration
186                 cp -f $tmp_sendmailmc /etc/mail/sendmail.mc
187                 rm -f $tmp_sendmailmc
188
189                 # edit /etc/mail/access to add local IP
190                 if ! grep "$PLC_RT_IP" /etc/mail/access ; then
191                         echo "$PLC_RT_IP                RELAY" >> /etc/mail/access
192                         makemap hash /etc/mail/access.db < /etc/mail/access
193                 fi
194                 if [ !  -f /etc/smrsh/rt-mailgate ] ; then
195                         ln -s /usr/sbin/rt-mailgate /etc/smrsh/rt-mailgate
196                 fi
197                 if ! grep "$PLC_RT_HOST" /etc/mail/local-host-names ; then
198                         # edit /etc/mail/local-host-names
199                         echo "$PLC_RT_HOST" >> /etc/mail/local-host-names
200                 fi
201                 m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
202                 service sendmail restart
203         fi
204
205
206 }
207
208 if [ "$PLC_RT_ENABLED" != "1" ] ; then
209     exit 0
210 fi
211
212 case "$1" in
213         start)
214                 MESSAGE=$"Bootstrap RT (please wait...)"
215                 dialog "$MESSAGE"
216
217                 check_pg_hba $RT3_DB_NAME $RT3_DB_USER
218                 #check_user_and_db $RT3_DB_NAME $RT3_DB_USER
219                 check_rt_siteconfig
220                 # TODO: make this dependent on whether a change was made!
221                 service plc restart httpd
222
223                 check_rt_pghba
224                 if [ -n "$WROTE_PG_CONFIG" ] ; then
225                         # NOTE: restart db to enable access by users granted above.
226                         service plc restart postgresql
227                         MESSAGE=$"Bootstrap RT 2 (please wait...)"
228                         dialog "$MESSAGE"
229                 fi
230                 check_rt_aliases
231                 check_rt_init
232                 check_rt_sendmail
233                 check_rt_custom         # todo: restart httpd if needed.
234
235                 # NOTE: remove external permission
236                 # This is needed to allow it to run without localhost
237                 # TODO: find a better way to do this.
238
239                 # remove 'trust' entry from .conf file
240                 sed -i -e "s/.*trust//g" $PGDATA/pg_hba.conf.d/${RT3_DB_NAME}.conf
241                 if [ -n "$WROTE_PG_CONFIG" ] ; then
242                         # NOTE: restart db to enable access by users granted above.
243                         service plc restart postgresql
244                         MESSAGE=$"Bootstrap RT 3 (please wait...)"
245                         dialog "$MESSAGE"
246                 fi
247
248                 result "$MESSAGE"
249         ;;
250
251
252         delete)
253                 MESSAGE=$"Deleting databases..."
254                 dialog "$MESSAGE"
255
256                 service plc stop httpd
257
258                 dropdb -U postgres $RT3_DB_NAME
259                 dropuser -U postgres $RT3_DB_USER
260                 rm -f /etc/rt3/RT_SiteConfig.pm
261                 rm -f /etc/rt3/initialdata
262                 rm -f $PGDATA/pg_hba.conf.d/${RT3_DB_NAME}.conf
263
264                 sed -i -e "s/.*mailgate.*//g" /etc/aliases
265                 rm -f /etc/rt3/setup.finished
266
267                 sed -i -e "s/Port=smtp, Name=MTA/Port=smtp,Addr=127.0.0.1, Name=MTA/g" /etc/mail/sendmail.mc
268                 service plc start httpd
269
270                 result "$MESSAGE"
271         ;;
272
273         stop)
274                 MESSAGE=$"Stopping RT"
275                 dialog "$MESSAGE"
276
277                 # TODO: is there anything to stop?
278
279                 result "$MESSAGE"
280         ;;
281 esac
282
283 exit $ERRORS