diff --git a/amazon-amd64-nix.pkr.hcl b/amazon-amd64-nix.pkr.hcl index 9d2d2fd2eb..a3e4cf014a 100644 --- a/amazon-amd64-nix.pkr.hcl +++ b/amazon-amd64-nix.pkr.hcl @@ -188,6 +188,11 @@ build { destination = "/tmp/70-ec2-nvme-devices.rules" } + provisioner "file" { + source = "ebssurrogate/scripts/provision-common.sh" + destination = "/tmp/provision-common.sh" + } + provisioner "file" { source = "ebssurrogate/scripts/chroot-bootstrap-nix.sh" destination = "/tmp/chroot-bootstrap-nix.sh" diff --git a/amazon-arm64-nix.pkr.hcl b/amazon-arm64-nix.pkr.hcl index 74fc2755a8..03d98a44ba 100644 --- a/amazon-arm64-nix.pkr.hcl +++ b/amazon-arm64-nix.pkr.hcl @@ -188,6 +188,11 @@ build { destination = "/tmp/70-ec2-nvme-devices.rules" } + provisioner "file" { + source = "ebssurrogate/scripts/provision-common.sh" + destination = "/tmp/provision-common.sh" + } + provisioner "file" { source = "ebssurrogate/scripts/chroot-bootstrap-nix.sh" destination = "/tmp/chroot-bootstrap-nix.sh" diff --git a/ebssurrogate/scripts/chroot-bootstrap-nix.sh b/ebssurrogate/scripts/chroot-bootstrap-nix.sh index 1c0e2cfa2d..cd696aade2 100755 --- a/ebssurrogate/scripts/chroot-bootstrap-nix.sh +++ b/ebssurrogate/scripts/chroot-bootstrap-nix.sh @@ -8,6 +8,9 @@ set -o errexit set -o pipefail set -o xtrace +# shellcheck source=/dev/null +source /tmp/provision-common.sh + function setup_apt { export DEBIAN_FRONTEND=noninteractive } @@ -92,31 +95,6 @@ function install_initial_packages { fi } -function setup_locale { - cat >>/etc/locale.gen <<-EOF - en_US.UTF-8 UTF-8 - EOF - cat >/etc/default/locale <<-EOF - LANG="C.UTF-8" - LC_CTYPE="C.UTF-8" - EOF - locale-gen en_US.UTF-8 -} - -function setup_postgesql_env { - # Create the directory if it doesn't exist - mkdir -p /etc/environment.d - - # Define the contents of the PostgreSQL environment file - tee /etc/environment.d/postgresql.env >/dev/null <<-EOF - LOCALE_ARCHIVE=/usr/lib/locale/locale-archive - LANG="en_US.UTF-8" - LANGUAGE="en_US.UTF-8" - LC_ALL="en_US.UTF-8" - LC_CTYPE="en_US.UTF-8" - EOF -} - function setup_apparmor { # Copy apparmor profiles cp -rv /tmp/apparmor_profiles/* /etc/apparmor.d/ @@ -179,13 +157,6 @@ function setup_eth0_interface { chmod 600 /etc/netplan/eth0.yaml } -function disable_sshd_passwd_auth { - sed -i -E \ - -e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \ - -e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \ - /etc/ssh/sshd_config -} - function create_admin_account { groupadd admin } diff --git a/ebssurrogate/scripts/cleanup-qemu.sh b/ebssurrogate/scripts/cleanup-qemu.sh index 9c79a981cd..512c98c3cc 100755 --- a/ebssurrogate/scripts/cleanup-qemu.sh +++ b/ebssurrogate/scripts/cleanup-qemu.sh @@ -6,13 +6,13 @@ set -ex +# shellcheck source=/dev/null +source /tmp/provision-common.sh + # Ensure /tmp exists and has the proper permissions before # checking for security updates # https://github.com/digitalocean/marketplace-partners/issues/94 -if [[ ! -d /tmp ]]; then - mkdir /tmp -fi -chmod 1777 /tmp +ensure_tmp_dir # Cleanup more packages packages=( @@ -117,31 +117,13 @@ systemctl disable getty@tty1.service systemctl mask getty@tty1.service systemctl mask graphical.target -rm -rf /tmp/* /var/tmp/* -history -c -cat /dev/null >/root/.bash_history -unset HISTFILE +scrub_history journalctl --rotate journalctl --vacuum-time=1s -find /var/log -mtime -1 -type f -exec truncate -s 0 {} \; -rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-???????? -rm -rf /var/lib/cloud/instances/* -rm -f /root/.ssh/authorized_keys /etc/ssh/*key* -touch /etc/ssh/revoked_keys -chmod 600 /etc/ssh/revoked_keys - -cat /dev/null >/var/log/lastlog -cat /dev/null >/var/log/wtmp +scrub_logs_and_keys -dd if=/dev/zero of=/zerofile & -PID=$! -while [ -d /proc/$PID ]; do - printf "." - sleep 5 -done -sync -rm /zerofile -sync +zero_free_space +empty_login_records fstrim / diff --git a/ebssurrogate/scripts/cleanup.sh b/ebssurrogate/scripts/cleanup.sh index f9a103fb02..6e33b5f507 100755 --- a/ebssurrogate/scripts/cleanup.sh +++ b/ebssurrogate/scripts/cleanup.sh @@ -6,13 +6,13 @@ set -ex +# shellcheck source=/dev/null +source /tmp/provision-common.sh + # Ensure /tmp exists and has the proper permissions before # checking for security updates # https://github.com/digitalocean/marketplace-partners/issues/94 -if [[ ! -d /tmp ]]; then - mkdir /tmp -fi -chmod 1777 /tmp +ensure_tmp_dir # Cleanup more packages packages=( @@ -39,16 +39,8 @@ apt-get --yes autoclean apt-get --yes update apt-get --yes upgrade -rm -rf /tmp/* /var/tmp/* -history -c -cat /dev/null >/root/.bash_history -unset HISTFILE -find /var/log -mtime -1 -type f -exec truncate -s 0 {} \; -rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-???????? -rm -rf /var/lib/cloud/instances/* -rm -f /root/.ssh/authorized_keys /etc/ssh/*key* -touch /etc/ssh/revoked_keys -chmod 600 /etc/ssh/revoked_keys +scrub_history +scrub_logs_and_keys # Securely erase the unused portion of the filesystem cat <<-EOF @@ -59,14 +51,5 @@ cat <<-EOF Beginning secure erase now EOF -dd if=/dev/zero of=/zerofile & -PID=$! -while [ -d /proc/$PID ]; do - printf "." - sleep 5 -done -sync -rm /zerofile -sync -cat /dev/null >/var/log/lastlog -cat /dev/null >/var/log/wtmp +zero_free_space +empty_login_records diff --git a/ebssurrogate/scripts/nix-provision.sh b/ebssurrogate/scripts/nix-provision.sh index e8470fc635..17b24ecff9 100755 --- a/ebssurrogate/scripts/nix-provision.sh +++ b/ebssurrogate/scripts/nix-provision.sh @@ -5,94 +5,39 @@ set -o errexit set -o pipefail set -o xtrace +# shellcheck source=/dev/null +source /tmp/provision-common.sh + exec 1>&2 function setup_apt { export DEBIAN_FRONTEND=noninteractive } -function cleanup_apt { - apt-get clean - apt-get autoremove --purge --yes - rm -rf /var/lib/apt/lists/* -} - -function update_and_upgrade_apt { - apt-get update --yes - apt-get dist-upgrade --yes -} - function install_packages { apt-get install -y ansible ansible-galaxy collection install community.general } -function install_nix() { - curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --yes --daemon --nix-extra-conf-file <( - cat <<-EOF - extra-experimental-features = nix-command flakes - extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com - extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= - EOF - ) - - #shellcheck disable=SC1091 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix --version -} - function execute_stage2_playbook { echo "POSTGRES_MAJOR_VERSION: $POSTGRES_MAJOR_VERSION" echo "GIT_SHA: $GIT_SHA" - mkdir -p /etc/ansible - tee /etc/ansible/ansible.cfg <<-EOF - [defaults] - callbacks_enabled = timer, profile_tasks, profile_roles - EOF - sed -i 's/- hosts: all/- hosts: localhost/' /tmp/ansible-playbook/ansible/playbook.yml - - # Run Ansible playbook - export ANSIBLE_LOG_PATH=/tmp/ansible.log - export ANSIBLE_REMOTE_TEMP=/tmp # shellcheck disable=SC2086 - ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \ - --extra-vars '{"stage2":true, "qemu":false}' \ - --extra-vars "git_commit_sha=$GIT_SHA" \ - --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ - --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ - --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ - $ARGS + run_playbook /tmp/ansible-playbook/ansible/playbook.yml /tmp true false $ARGS } function cleanup_packages { apt-get remove --purge --yes ansible } -function cleanup_nix { - nix-collect-garbage -d - nix-store --optimise -v -} - -function report_packages { - # shellcheck disable=SC2016 - dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort - find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 -} - -function report_disk_usage { - read -r dub _ < <(du -sx -B1 /) - read -r duh _ < <(du -sx -h /) - printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log -} - setup_apt update_and_upgrade_apt install_packages install_nix execute_stage2_playbook cleanup_packages -cleanup_nix +clean_nix update_and_upgrade_apt cleanup_apt report_packages diff --git a/ebssurrogate/scripts/provision-common.sh b/ebssurrogate/scripts/provision-common.sh new file mode 100644 index 0000000000..a204b63587 --- /dev/null +++ b/ebssurrogate/scripts/provision-common.sh @@ -0,0 +1,171 @@ +# shellcheck shell=bash + +function update_and_upgrade_apt { + apt-get update --yes + apt-get dist-upgrade --yes +} + +function cleanup_apt { + apt-get clean + apt-get autoremove --purge --yes + rm -rf /var/lib/apt/lists/* +} + +function install_nix() { + curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --yes --daemon --nix-extra-conf-file <( + cat <<-EOF + extra-experimental-features = nix-command flakes + extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com + extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= + EOF + ) + + # shellcheck disable=SC1091 + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + nix --version +} + +function run_playbook { + local playbook=$1 remote_tmp=$2 stage2=$3 qemu=$4 + shift 4 + + local sha_args=() + if [[ $stage2 == true ]]; then + sha_args=(--extra-vars "git_commit_sha=$GIT_SHA") + fi + + mkdir -p /etc/ansible + tee /etc/ansible/ansible.cfg <<-EOF + [defaults] + callbacks_enabled = timer, profile_tasks, profile_roles + EOF + sed -i 's/- hosts: all/- hosts: localhost/' "$playbook" + + export ANSIBLE_LOG_PATH=/tmp/ansible.log + export ANSIBLE_REMOTE_TEMP=$remote_tmp + + ansible-playbook "$playbook" \ + --extra-vars "{\"stage2\":$stage2,\"qemu\":$qemu}" \ + "${sha_args[@]}" \ + --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ + --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ + --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ + "$@" +} + +function clean_nix { + nix-collect-garbage -d + nix-store --optimise -v +} + +function report_packages { + # shellcheck disable=SC2016 + dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort + find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 +} + +function report_disk_usage { + read -r dub _ < <(du -sx -B1 /) + read -r duh _ < <(du -sx -h /) + printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log +} + +function setup_locale { + cat >>/etc/locale.gen <<-EOF + en_US.UTF-8 UTF-8 + EOF + cat >/etc/default/locale <<-EOF + LANG="C.UTF-8" + LC_CTYPE="C.UTF-8" + EOF + locale-gen en_US.UTF-8 +} + +function setup_postgesql_env { + mkdir -p /etc/environment.d + + tee /etc/environment.d/postgresql.env >/dev/null <<-EOF + LOCALE_ARCHIVE=/usr/lib/locale/locale-archive + LANG="en_US.UTF-8" + LANGUAGE="en_US.UTF-8" + LC_ALL="en_US.UTF-8" + LC_CTYPE="en_US.UTF-8" + EOF +} + +function disable_sshd_passwd_auth { + sed -i -E \ + -e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \ + -e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \ + /etc/ssh/sshd_config +} + +function ensure_tmp_dir { + # https://github.com/digitalocean/marketplace-partners/issues/94 + if [[ ! -d /tmp ]]; then + mkdir /tmp + fi + chmod 1777 /tmp +} + +function scrub_history { + rm -rf /tmp/* /var/tmp/* + history -c + cat /dev/null >/root/.bash_history + unset HISTFILE +} + +function scrub_logs_and_keys { + find /var/log -mtime -1 -type f -exec truncate -s 0 {} \; + rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-???????? + rm -rf /var/lib/cloud/instances/* + rm -f /root/.ssh/authorized_keys /etc/ssh/*key* + touch /etc/ssh/revoked_keys + chmod 600 /etc/ssh/revoked_keys +} + +function zero_free_space { + dd if=/dev/zero of=/zerofile & + PID=$! + while [ -d /proc/$PID ]; do + printf "." + sleep 5 + done + sync + rm /zerofile + sync +} + +function empty_login_records { + cat /dev/null >/var/log/lastlog + cat /dev/null >/var/log/wtmp +} + +function setup_image_logs { + local root=${1:-} run=() + if [[ -n $root ]]; then + run=(chroot "$root") + fi + + rm -rf "$root"/var/log/* + # https://github.com/fail2ban/fail2ban/issues/1593 + touch "$root/var/log/auth.log" + + touch "$root/var/log/pgbouncer.log" + "${run[@]}" chown pgbouncer:postgres /var/log/pgbouncer.log + + mkdir -p "$root/var/log/postgresql" + "${run[@]}" chown postgres:postgres /var/log/postgresql + + mkdir "$root/var/log/wal-g" + touch "$root"/var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log} + + mkdir "$root/var/log/sysstat" + + "${run[@]}" chown -R postgres:postgres /var/log/wal-g + # vector reads pitr.log; modes match the salt vector formula + "${run[@]}" chmod -R 0310 /var/log/wal-g + "${run[@]}" chmod 0340 /var/log/wal-g/pitr.log + + mkdir "$root/var/log/audit" +} diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh index c064454b0d..f378d04f8e 100755 --- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh +++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh @@ -4,6 +4,9 @@ set -o errexit set -o pipefail set -o xtrace +# shellcheck source=/dev/null +source /tmp/provision-common.sh + ################# # stage1 things # ################# @@ -42,17 +45,6 @@ function setup_apt { sed -i "s|$defmirror|& $ubumirror|" /etc/apt/sources.list.d/ubuntu.sources } -function cleanup_apt { - apt-get clean - apt-get autoremove --purge --yes - rm -rf /var/lib/apt/lists/* -} - -function update_and_upgrade_apt { - apt-get update --yes - apt-get dist-upgrade --yes -} - function waitfor_boot_finished { # Wait for cloudinit on the surrogate to complete before making progress while [[ ! -f /var/lib/cloud/instance/boot-finished ]]; do @@ -81,84 +73,18 @@ function install_packages { } function execute_playbook { - sed -i 's/- hosts: all/- hosts: localhost/' ansible/playbook.yml - - mkdir -p /etc/ansible - tee /etc/ansible/ansible.cfg <<-EOF - [defaults] - callbacks_enabled = timer, profile_tasks, profile_roles - EOF - - # Run Ansible playbook - export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/mnt/tmp - ansible-playbook ./ansible/playbook.yml --extra-vars '{"stage2": false, "qemu": true}' \ - --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ - --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ + run_playbook ./ansible/playbook.yml /mnt/tmp false true \ --extra-vars "postgresql_major=$POSTGRES_MAJOR_VERSION" \ - --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ --extra-vars @./ansible/qemu-vars.yaml } -function setup_postgesql_env { - # Create the directory if it doesn't exist - mkdir -p /etc/environment.d - - # Define the contents of the PostgreSQL environment file - tee /etc/environment.d/postgresql.env >/dev/null <<-EOF - LOCALE_ARCHIVE=/usr/lib/locale/locale-archive - LANG="en_US.UTF-8" - LANGUAGE="en_US.UTF-8" - LC_ALL="en_US.UTF-8" - LC_CTYPE="en_US.UTF-8" - EOF -} - -function setup_locale { - cat >>/etc/locale.gen <<-EOF - en_US.UTF-8 UTF-8 - EOF - - cat >/etc/default/locale <<-EOF - LANG="C.UTF-8" - LC_CTYPE="C.UTF-8" - EOF - locale-gen en_US.UTF-8 -} - ################# # stage2 things # ################# -function install_nix() { - curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- --yes --daemon --nix-extra-conf-file <( - cat <<-EOF - extra-experimental-features = nix-command flakes - extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com - extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= - EOF - ) - - # shellcheck disable=SC1091 - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - nix --version -} - function execute_stage2_playbook { - mkdir -p /etc/ansible - tee /etc/ansible/ansible.cfg <<-EOF - [defaults] - callbacks_enabled = timer, profile_tasks, profile_roles - EOF - - # Run Ansible playbook - export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/tmp - ansible-playbook ./ansible/playbook.yml \ - --extra-vars '{"stage2": true, "qemu": true}' \ - --extra-vars "git_commit_sha=$GIT_SHA" \ - --extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \ - --extra-vars "postgresql_major_version=$POSTGRES_MAJOR_VERSION" \ + run_playbook ./ansible/playbook.yml /tmp true true \ --extra-vars "postgresql_major=$POSTGRES_MAJOR_VERSION" \ - --extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \ --extra-vars @./ansible/qemu-vars.yaml } @@ -178,31 +104,7 @@ function clean_system { chmod +x /tmp/cleanup-qemu.sh /tmp/cleanup-qemu.sh - # Cleanup logs - rm -rf /var/log/* - # https://github.com/fail2ban/fail2ban/issues/1593 - touch /var/log/auth.log - - touch /var/log/pgbouncer.log - chown pgbouncer:postgres /var/log/pgbouncer.log - - # Setup postgresql logs - mkdir -p /var/log/postgresql - chown postgres:postgres /var/log/postgresql - # Setup wal-g logs - mkdir /var/log/wal-g - touch /var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log} - - # Creatre Sysstat directory for SAR - mkdir /var/log/sysstat - - chown -R postgres:postgres /var/log/wal-g - # moving up fixes from init scripts - chmod -R 0310 /var/log/wal-g - chmod 0340 /var/log/wal-g/pitr.log - - # audit logs directory for apparmor - mkdir /var/log/audit + setup_image_logs # unwanted files rm -rf /root/.cache @@ -216,10 +118,7 @@ function clean_system { # Ensure that PasswordAuthentication is off # From chroot-boostrap-nix.sh - sed -i -E \ - -e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \ - -e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \ - /etc/ssh/sshd_config + disable_sshd_passwd_auth if ! grep -qE "^PasswordAuthentication\s+no" /etc/ssh/sshd_config; then echo "ERROR: PasswordAuthentication is not disabled in sshd_config" @@ -227,23 +126,6 @@ function clean_system { fi } -function clean_nix { - nix-collect-garbage -d - nix-store --optimise -v -} - -function report_packages { - # shellcheck disable=SC2016 - dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' | LC_COLLATE=C.UTF-8 sort - find /nix/store -maxdepth 1 | LC_COLLATE=C.UTF-8 sort -t- -k2 -} - -function report_disk_usage { - read -r dub _ < <(du -sx -B1 /) - read -r duh _ < <(du -sx -h /) - printf '::notice::disk_usage bytes=%s human=%s\n' "$dub" "$duh" | tee -a /tmp/ansible.log -} - ################# # stage1 things # ################# diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh index 2f43a5a458..1d8bbd5d63 100755 --- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh +++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh @@ -207,6 +207,7 @@ function setup_chroot_environment { cp -r /tmp/migrations /mnt/tmp/ # Copy the bootstrap script into place and execute inside chroot + cp /tmp/provision-common.sh /mnt/tmp/provision-common.sh cp /tmp/chroot-bootstrap-nix.sh /mnt/tmp/chroot-bootstrap-nix.sh chroot /mnt /tmp/chroot-bootstrap-nix.sh rm -f /mnt/tmp/chroot-bootstrap-nix.sh @@ -270,40 +271,12 @@ function update_systemd_services { function clean_system { # Copy cleanup scripts + cp -v /tmp/provision-common.sh /mnt/tmp cp -v /tmp/cleanup.sh /mnt/tmp chmod +x /mnt/tmp/cleanup.sh chroot /mnt /tmp/cleanup.sh - # Cleanup logs - rm -rf /mnt/var/log/* - # https://github.com/fail2ban/fail2ban/issues/1593 - touch /mnt/var/log/auth.log - - touch /mnt/var/log/pgbouncer.log - if [[ -f /usr/bin/chown ]]; then - chroot /mnt /usr/bin/chown pgbouncer:postgres /var/log/pgbouncer.log - fi - - # Setup postgresql logs - mkdir -p /mnt/var/log/postgresql - if [[ -f /usr/bin/chown ]]; then - chroot /mnt /usr/bin/chown postgres:postgres /var/log/postgresql - fi - - # Setup wal-g logs - mkdir /mnt/var/log/wal-g - touch /mnt/var/log/wal-g/{backup-push.log,backup-fetch.log,wal-push.log,wal-fetch.log,pitr.log} - - #Creatre Sysstat directory for SAR - mkdir /mnt/var/log/sysstat - - if [[ -f /usr/bin/chown ]]; then - chroot /mnt /usr/bin/chown -R postgres:postgres /var/log/wal-g - chroot /mnt /usr/bin/chmod -R 0300 /var/log/wal-g - fi - - # audit logs directory for apparmor - mkdir /mnt/var/log/audit + setup_image_logs /mnt # unwanted files rm -rf /mnt/var/lib/apt/lists/* diff --git a/qemu.pkr.hcl b/qemu.pkr.hcl index ab854240f0..feb1232cde 100644 --- a/qemu.pkr.hcl +++ b/qemu.pkr.hcl @@ -106,6 +106,11 @@ build { destination = "/tmp/cleanup-qemu.sh" } + provisioner "file" { + source = "ebssurrogate/scripts/provision-common.sh" + destination = "/tmp/provision-common.sh" + } + provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}", diff --git a/stage2-nix-psql.pkr.hcl b/stage2-nix-psql.pkr.hcl index 7278ccd2bf..0a8590bb8e 100644 --- a/stage2-nix-psql.pkr.hcl +++ b/stage2-nix-psql.pkr.hcl @@ -137,6 +137,11 @@ build { destination = "/tmp/ansible-playbook" } + provisioner "file" { + source = "ebssurrogate/scripts/provision-common.sh" + destination = "/tmp/provision-common.sh" + } + provisioner "shell" { environment_vars = [ "GIT_SHA=${var.git_sha}",