49 lines
1.8 KiB
Bash
49 lines
1.8 KiB
Bash
[ -e /dev/mapper/secret ] && refuse "a device-mapper device called secret already exists; close it and start again"
|
|
findmnt /mnt/secret >/dev/null && refuse "something is mounted on /mnt/secret; unmount it and start again"
|
|
grep -Eqs '^[[:space:]]*secret[[:space:]]' /etc/crypttab && refuse "/etc/crypttab already has an entry called secret; remove it and start again"
|
|
[ -e /root/secret.key ] && refuse "/root/secret.key already exists; move it away and start again"
|
|
# Reset removes every package installed from here on, by setup or by the
|
|
# tasks, and only those.
|
|
pkgs_now() { if is_rhel; then rpm -qa --qf '%{NAME}\n'; else dpkg-query -W -f '${db:Status-Abbrev} ${Package}\n' | awk '$1 == "ii" { print $2 }'; fi | sort -u; }
|
|
pkgs_now >"$LAB_STATE/pkgs-before"
|
|
cp -a /etc/fstab "$LAB_STATE/fstab"
|
|
[ -f /etc/crypttab ] && cp -a /etc/crypttab "$LAB_STATE/crypttab"
|
|
|
|
disk_add 0 512M >/dev/null
|
|
is_debian && user_add crypto
|
|
|
|
# The peer's Tang server: its own keys, on the peer's port 80.
|
|
pkg_install tang
|
|
systemctl disable --now --quiet tangd.socket 2>/dev/null || true
|
|
K=$(pick /var/db/tang /var/lib/tang)
|
|
mkdir -p $K
|
|
ls $K/*.jwk >/dev/null 2>&1 || /usr/libexec/tangd-keygen $K
|
|
peer_up
|
|
cat >/etc/systemd/system/le-lab-peer-tang.socket <<'X'
|
|
[Unit]
|
|
Description=Practice lab Tang server on the peer
|
|
DefaultDependencies=no
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service
|
|
|
|
[Socket]
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
ListenStream=10.99.0.2:80
|
|
Accept=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
cat >/etc/systemd/system/[email protected] <<X
|
|
[Unit]
|
|
Description=Practice lab Tang server on the peer (connection)
|
|
|
|
[Service]
|
|
StandardInput=socket
|
|
StandardOutput=socket
|
|
StandardError=journal
|
|
ExecStart=/usr/libexec/tangd $K
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-peer-tang.socket
|