69 lines
2.3 KiB
Bash
69 lines
2.3 KiB
Bash
peer_up
|
|
for p in nginx haproxy; do
|
|
if pkg_installed $p && [ -d /etc/$p ]; then
|
|
state_set had-$p 1
|
|
tar -C /etc -cf "$LAB_STATE/$p.tar" $p
|
|
fi
|
|
done
|
|
command -v getenforce >/dev/null && state_set selinux "$(getenforce)"
|
|
command -v getsebool >/dev/null && state_set httpd-connect "$(getsebool httpd_can_network_connect | awk '{print $3}')"
|
|
|
|
mkdir -p /usr/local/lib/le-lab
|
|
cat >/usr/local/lib/le-lab/backend.py <<'X'
|
|
# A practice lab back end: answers every request with a page naming it,
|
|
# and logs (and saves) the X-Forwarded-For header it gets.
|
|
import http.server, os, socketserver, sys
|
|
|
|
port = int(sys.argv[1])
|
|
state = "/run/le-backend"
|
|
os.makedirs(state, exist_ok=True)
|
|
|
|
|
|
class Handler(http.server.BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
xff = self.headers.get("X-Forwarded-For")
|
|
if xff is not None:
|
|
with open(f"{state}/{port}.xff", "w") as f:
|
|
f.write(xff + "\n")
|
|
body = f"Back end {port}\n".encode()
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "text/plain")
|
|
self.send_header("Content-Length", str(len(body)))
|
|
self.end_headers()
|
|
self.wfile.write(body)
|
|
|
|
def log_message(self, fmt, *args):
|
|
xff = self.headers.get("X-Forwarded-For", "-") if hasattr(self, "headers") else "-"
|
|
sys.stderr.write(f"{self.address_string()} {fmt % args} X-Forwarded-For: {xff}\n")
|
|
|
|
|
|
class Server(http.server.ThreadingHTTPServer):
|
|
# Without HTTPServer's reverse DNS lookup of the address.
|
|
def server_bind(self):
|
|
socketserver.TCPServer.server_bind(self)
|
|
self.server_name, self.server_port = self.server_address[:2]
|
|
|
|
|
|
Server(("127.0.0.1", port), Handler).serve_forever()
|
|
X
|
|
cat >/etc/systemd/system/[email protected] <<'X'
|
|
[Unit]
|
|
Description=Practice lab back end on port %i
|
|
After=network.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/bin/python3 /usr/local/lib/le-lab/backend.py %i
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-backend@8081 le-backend@8082 le-backend@8083
|
|
|
|
# Save the firewall's configuration, if one runs, for reset.
|
|
if systemctl is-active --quiet firewalld; then
|
|
tar -C /etc -cf "$LAB_STATE/firewalld.tar" firewalld
|
|
elif command -v ufw >/dev/null && ufw status | grep -q 'Status: active'; then
|
|
tar -C /etc -cf "$LAB_STATE/ufw.tar" ufw
|
|
fi
|