From cbcd022f302adc39ecb89fba6faf72e68184c0e0 Mon Sep 17 00:00:00 2001 From: Cullum Smith Date: Fri, 2 Aug 2024 19:10:39 -0400 Subject: halfway working idm server and laptop hostclasses --- scripts/hostclass/desktop | 98 ++++++++++++ scripts/hostclass/idm_server/10-slapd | 165 +++++++++++++++++++++ scripts/hostclass/idm_server/20-powerdns | 114 ++++++++++++++ scripts/hostclass/idm_server/30-kdc | 12 ++ scripts/hostclass/idm_server/90-idm | 9 ++ scripts/hostclass/laptop | 15 ++ scripts/hostclass/pkg_repository | 6 +- scripts/hostclass/roadwarrior_laptop/10-desktop | 1 + scripts/hostclass/roadwarrior_laptop/20-laptop | 1 + .../hostclass/roadwarrior_laptop/30-roadwarrior | 6 + 10 files changed, 426 insertions(+), 1 deletion(-) create mode 100644 scripts/hostclass/desktop create mode 100644 scripts/hostclass/idm_server/10-slapd create mode 100644 scripts/hostclass/idm_server/20-powerdns create mode 100644 scripts/hostclass/idm_server/30-kdc create mode 100644 scripts/hostclass/idm_server/90-idm create mode 100644 scripts/hostclass/laptop create mode 120000 scripts/hostclass/roadwarrior_laptop/10-desktop create mode 120000 scripts/hostclass/roadwarrior_laptop/20-laptop create mode 100644 scripts/hostclass/roadwarrior_laptop/30-roadwarrior (limited to 'scripts/hostclass') diff --git a/scripts/hostclass/desktop b/scripts/hostclass/desktop new file mode 100644 index 0000000..d90081e --- /dev/null +++ b/scripts/hostclass/desktop @@ -0,0 +1,98 @@ +#!/bin/sh + +load_kernel_module linux linux64 acpi_ibm + +pkg install -y \ + chromium \ + compton \ + dino \ + dmenu \ + eclipse \ + firefox \ + git \ + krb5 \ + i3 \ + libreoffice \ + libva-intel-media-driver \ + networkmgr \ + py${python_version}-pip \ + stow \ + terminus-font \ + terminus-ttf \ + tmux \ + tree \ + wireguard-tools \ + xfontsel \ + xidle \ + xorg \ + xterm + +case $desktop_type in + i3) + pkg install \ + i3 \ + i3lock \ + i3status + ;; + kde) + pkg install \ + juk \ + k3b \ + kde5 \ + kid3-qt6 \ + kmix \ + konversation \ + sddm + ;; +esac + +set_sysctl \ + net.local.stream.recvspace=65536 \ + net.local.stream.sendspace=65536 \ + kern.sched.preempt_thresh=224 \ + vfs.usermount=1 \ + hw.snd.latency=7 + +set_loader_conf \ + kern.ipc.shmseg=1024 \ + kern.ipc.shmmni=1024 \ + kern.maxproc=100000 \ + linux_load=YES \ + linux64_load=YES \ + acpi_ibm_load=YES \ + compat.linuxkpi.i915_enable_dc=2 \ + compat.linuxkpi.i915_enable_fbc=1 \ + compat.linuxkpi.i915_fastboot=1 \ + compat.linuxkpi.i915_disable_power_well=1 \ + machdep.hwpstate_pkg_ctrl=0 \ + vfs.zfs.txg.timeout=10 \ + hw.pci.do_power_nodriver=3 + +# Create policy file for firefox. +install_directory -m 0755 /usr/local/lib/firefox/distribution +install_template -m 0644 /usr/local/lib/firefox/distribution/policies.json + +# Create policy file for chromium. +install_directory -m 0755 \ + /usr/local/etc/chromium/policies \ + /usr/local/etc/chromium/policies/managed +install_template -m 0644 /usr/local/etc/chromium/policies/managed/policies.json + +# Configure libreoffice +install_file -m 0644 /usr/local/lib/libreoffice/program/sofficerc + +# Add terminus font to X11 +install_file -m 0644 /usr/local/etc/X11/xorg.conf.d/terminus.conf + +# Enable dbus. +sysrc -v dbus_enable=YES +service dbus status || service dbus start + +# Configure graphics drivers. +case $graphics_type in + intel) + pkg install -y drm-kmod + sysrc -v kld_list+=i915kms + load_kernel_module i915kms + ;; +esac diff --git a/scripts/hostclass/idm_server/10-slapd b/scripts/hostclass/idm_server/10-slapd new file mode 100644 index 0000000..dc52a58 --- /dev/null +++ b/scripts/hostclass/idm_server/10-slapd @@ -0,0 +1,165 @@ +#!/bin/sh + +: ${slapd_root_dn:='cn=admin'} +: ${slapd_replicator_dn:="cn=replicator,${basedn}"} +: ${slapd_result_size_limit:='10000'} +: ${slapd_db_max_size:='1073741824'} # 1 GB +: ${slapd_accesslog_db_max_size:='134217728'} # 128 MB +: ${slapd_syncrepl_checkpoint_ops:='100'} +: ${slapd_syncrepl_checkpoint_minutes:='10'} +: ${slapd_syncrepl_session_log:='1000'} +: ${slapd_syncrepl_cleanup_age:='7'} +: ${slapd_syncrepl_cleanup_interval:='1'} + +slapd_user=ldap +slapd_data_dir=/var/db/openldap-data +slapd_conf_dir=/usr/local/etc/openldap +slapd_tls_cert="${slapd_conf_dir}/slapd.crt" +slapd_tls_key="${slapd_conf_dir}/slapd.key" +slapd_replicator_tls_cert="${slapd_conf_dir}/replicator.crt" +slapd_replicator_tls_key="${slapd_conf_dir}/replicator.key" +slapd_keytab="${keytab_dir}/slapd.keytab" + +is_primary_server(){ + # Return 0 if the current hostname is equal to $idm_primary_server. + # If $idm_primary_server is unset, use the first hostname in $idm_server_list. + _primary="${idm_primary_server:-$(echo "$idm_server_list" | awk 'NR==1{print $1}')}" + test "$BOXCONF_HOSTNAME" = "$_primary" +} + +pkg install -y \ + openldap26-server \ + cyrus-sasl-saslauthd + +# Create ZFS dataset for OpenLDAP DB. +create_dataset -o "mountpoint=${slapd_data_dir}" "${state_dataset}/openldap-data" + +# Copy TLS certificate for LDAP server. +install_certificate -o "$slapd_user" -g "$slapd_user" slapd "$slapd_tls_cert" +install_certificate_key -o "$slapd_user" -g "$slapd_user" slapd "$slapd_tls_key" + +# Copy client certificate for LDAP replication. +install_certificate -o "$slapd_user" -g "$slapd_user" replicator "$slapd_replicator_tls_cert" +install_certificate_key -o "$slapd_user" -g "$slapd_user" replicator "$slapd_replicator_tls_key" + +# Copy LDIF for the cn=config database. +install_template -m 0600 "${slapd_conf_dir}/slapd.ldif" + +# Copy third-party schema files. +install_file -m 0644 \ + "${slapd_conf_dir}/schema/rfc2307bis.ldif" \ + "${slapd_conf_dir}/schema/kerberos.ldif" \ + "${slapd_conf_dir}/schema/openssh-lpk.ldif" \ + "${slapd_conf_dir}/schema/sudo.ldif" \ + "${slapd_conf_dir}/schema/dnsdomain2.ldif" \ + "${slapd_conf_dir}/schema/mailservice.ldif" + +# Create the directories for the LDAP databases. +install_directory -m 0770 -o "$slapd_user" -g "$slapd_user" \ + "${slapd_data_dir}" \ + "${slapd_data_dir}/accesslog" + +# If slapd.d doesn't exist, populate it with slapd.ldif. +if [ ! -d "${slapd_conf_dir}/slapd.d" ]; then + install_directory -m 0700 -o "$slapd_user" "${slapd_conf_dir}/slapd.d" + slapadd -v -n0 -F "${slapd_conf_dir}/slapd.d" -l "${slapd_conf_dir}/slapd.ldif" + chown -R "${slapd_user}:${slapd_user}" "${slapd_conf_dir}/slapd.d" +fi + +# Enable OpenLDAP in /etc/rc.conf, and start it. +# Note: whatever LDAP IP you specified in $slapd_server_list must be present in +# the `-h` argument to slapd. That's how slapd figures out its own server ID. +sysrc -v \ + slapd_enable=YES \ + slapd_cn_config=YES \ + slapd_flags="-h 'ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0/ ldaps://0.0.0.0/ ldaps://${BOXCONF_DEFAULT_IPV4}/'" \ + slapd_sockets="/var/run/openldap/ldapi" \ + slapd_krb5_ktname="$slapd_keytab" + +service slapd restart + +# Copy the LDAP client configs. +install_template -m 0644 "${slapd_conf_dir}/ldap.conf" + +# Copy slapd SASL configuration. +install_template -m 0644 /usr/local/lib/sasl2/slapd.conf + +# Allow slapd to read the saslauthd socket. +install_directory -m 0750 -o "$saslauthd_user" -g "$slapd_user" "$saslauthd_runtime_dir" + +# Enable and start saslauthd. +sysrc -v \ + saslauthd_flags='-a kerberos5' \ + saslauthd_enable=YES +service saslauthd restart + +# Create directory tree. +if is_primary_server; then + # dc=example,dc=com + ldap_add "$basedn" <