1 | ## Dit is een NanoBSD configuratie-template voor WirelessLeiden.
|
---|
2 | ## Instellingen weergegeven binnen dit bestand gelden als
|
---|
3 | ## standaard binnen de organisatie.
|
---|
4 |
|
---|
5 | # Little hack to allow proper secify of KERNL/PKG location
|
---|
6 | if [ -n "$NANO_CFG_FILE" ]; then
|
---|
7 | NANO_CONF_DIR=$(cd $(dirname $NANO_CFG_FILE); pwd -P)
|
---|
8 | else
|
---|
9 | NANO_CONF_DIR=$(cd $(dirname $2); pwd -P)
|
---|
10 | fi
|
---|
11 |
|
---|
12 | # object naam in /usr/obj/nanobsd.{obj}
|
---|
13 | NANO_NAME=wleiden-hybrid
|
---|
14 | NANO_SRC=/usr/src # nanobsd source tree
|
---|
15 | NANO_TOOLS=$(pwd)
|
---|
16 | NANO_KERNEL=$NANO_CONF_DIR/kernel.wleiden # naam van het kernel configuratiebestand
|
---|
17 | NANO_IMAGES=2 # aantal nanobsd code slices/installs (1/2)
|
---|
18 |
|
---|
19 | NANO_CONFSIZE=20480 # Volume van de config slice (10MB) in 512bs
|
---|
20 | NANO_DATASIZE=0 # volume van de data slice, 0 = not configured
|
---|
21 | NANO_CODESIZE=0 # Let buildscript the operating system slice as large as posible
|
---|
22 | NANO_RAM_TMPVARSIZE=102400 # Volume of combined var & tmp slice (50MB) in 512bs
|
---|
23 |
|
---|
24 | NANO_LABEL=WLIMG
|
---|
25 | NANO_NEWFS="-b 4096 -f 512 -i 8192" # Overwrite the default stettings to disable Soft-updates
|
---|
26 |
|
---|
27 |
|
---|
28 | #XXX: Eeks, fixed packages, needs building a hook to allow building the package
|
---|
29 | # of the shelfs if needed, copy to right directory, done. With only input needed
|
---|
30 | # a list of ports in the format like net/net-snmp
|
---|
31 | NANO_PACKAGE_DIR=$NANO_CONF_DIR/../pkg/All
|
---|
32 | NANO_PACKAGE_LIST="*"
|
---|
33 |
|
---|
34 |
|
---|
35 | # Wireless Leiden ports from $WL_PORTSDIR are copied OVER $PORTSDIR
|
---|
36 | PORTSDIR='/usr/ports'
|
---|
37 | WL_PORTSDIR="$NANO_CONF_DIR/../ports/"
|
---|
38 |
|
---|
39 | # Dirty quirk to allow comments in part below
|
---|
40 | PACKAGE_LIST=`cat <<EOF | sed -e 's/#.*$//g' | xargs
|
---|
41 | benchmarks/iperf
|
---|
42 | devel/py-yaml
|
---|
43 | editors/vim-lite
|
---|
44 | dns/dnsmasq
|
---|
45 | dns/nsd
|
---|
46 | dns/unbound
|
---|
47 | ftp/curl
|
---|
48 | lang/python2
|
---|
49 | lang/python
|
---|
50 | net/ladvd
|
---|
51 | net-mgmt/iftop
|
---|
52 | net-mgmt/net-snmp
|
---|
53 | net/mtr
|
---|
54 | net/isc-dhcp42-server
|
---|
55 | net/pen
|
---|
56 | ports-mgmt/pkg
|
---|
57 | security/sudo
|
---|
58 | security/ca_root_nss
|
---|
59 | sysutils/screen
|
---|
60 | sysutils/ucspi-tcp
|
---|
61 | www/apache24
|
---|
62 | www/tinyproxy
|
---|
63 |
|
---|
64 | # Extra WL ports
|
---|
65 | net/lvrouted
|
---|
66 | `
|
---|
67 | # Package target
|
---|
68 | PKG_MAKE_ARGS="PACKAGES=$(dirname $NANO_PACKAGE_DIR) BATCH=yes PACKAGE_BUILDING=yes"
|
---|
69 |
|
---|
70 | PKG_MAKE_CONF="
|
---|
71 | # www/py-cherrypy - include apache templating
|
---|
72 | # net-mgmt/net-snmp - no perl please (size)
|
---|
73 | # net-mgmt/nagios-plugins - no threading (single CPU)
|
---|
74 | # shells/bash-static - logging via syslog
|
---|
75 | # net/mtr - no X11 (no screen)
|
---|
76 | # lang/ocaml - no TK support (requires X11)
|
---|
77 | # devel/ocaml-findlib - no TOOLBOX support (requires ocaml with TK support)
|
---|
78 | OPTIONS_SET= APACHE FPING SYSLOG
|
---|
79 | OPTIONS_UNSET= PERL PERL_EMBEDDED X11 TK TOOLBOX
|
---|
80 | "
|
---|
81 |
|
---|
82 | ##NANO_PACKAGE_LIST=
|
---|
83 |
|
---|
84 | # Warning: set to 1 to debug make build errors
|
---|
85 | # Number of recurrent parrallel make builds
|
---|
86 | if `grep -q 'acpi0: <PRLS PRLS_OEM> on motherboard' /var/run/dmesg.boot`; then
|
---|
87 | # Mac OS X Parallels virtual machine
|
---|
88 | NANO_PMAKE="make -B"
|
---|
89 | else
|
---|
90 | # Default 2 times number of CPU's inside machine
|
---|
91 | NANO_PARALLEL_MAKE=`expr $(sysctl -n hw.ncpu) \* 2`
|
---|
92 | NANO_PMAKE="make -j ${NANO_PARALLEL_MAKE}"
|
---|
93 | fi
|
---|
94 |
|
---|
95 | # Starting from soekris bios version 1.31 upwards boot0sio does not seems work
|
---|
96 | # anymore, but boot0 does (weird)
|
---|
97 | NANO_BOOTLOADER="boot/boot0"
|
---|
98 |
|
---|
99 | # Strip down to a more acceptable size
|
---|
100 | # hints from http://people.freebsd.org/~phk/nanobsd/soekris_4x26/make.soekris_4x26.conf (46MB)
|
---|
101 | NANO_PRUNE="$NANO_PRUNE usr/share/examples"
|
---|
102 | NANO_PRUNE="$NANO_PRUNE usr/share/syscons"
|
---|
103 | NANO_PRUNE="$NANO_PRUNE usr/share/calendar"
|
---|
104 | # NB! usr/share/misc contains termcap, vi(1) etc fails to work without it.
|
---|
105 | # NANOBSD_PRUNE += usr/share/misc
|
---|
106 | NANO_PRUNE="$NANO_PRUNE usr/share/pcvt"
|
---|
107 | NANO_PRUNE="$NANO_PRUNE usr/share/me"
|
---|
108 | NANO_PRUNE="$NANO_PRUNE usr/share/doc"
|
---|
109 |
|
---|
110 |
|
---|
111 |
|
---|
112 |
|
---|
113 |
|
---|
114 | # Opties parsed gedurende build & install world
|
---|
115 | # Also check man 3 src.conf for details
|
---|
116 | # Some flags are misleading, e.g. could only be installworld (e.g.), for details:
|
---|
117 | # http://phk.freebsd.dk/misc/build_options/
|
---|
118 | # For details on make options also check:
|
---|
119 | # /usr/src/share/mk/bsd.own.mk
|
---|
120 | CONF_COMMON='
|
---|
121 | # Specific enabled options
|
---|
122 | #WITHOUT_ACPI=YES # geen advanced configuration power interface
|
---|
123 | #WITHOUT_BIND=YES # geen bind tools, dns/named geinstalleerd
|
---|
124 | #WITHOUT_CXX=YES # Set to not build g++(1) and related libraries.
|
---|
125 | #WITHOUT_GROFF=YES # Set to not build groff(1).
|
---|
126 | #WITHOUT_INET6=YES # geen ondersteuning inet versie 6 architectuur
|
---|
127 | #WITHOUT_INFO=YES # geen info bestanden, readable online docs
|
---|
128 | #WITHOUT_IPFILTER=YES # geen ip filtering geinstalleerd
|
---|
129 | #WITHOUT_KLDLOAD=YES # do not allow loading of kernel modules
|
---|
130 | #WITHOUT_MAILWRAPPER=YES # geen mailwrapper bij gebruik sendmail
|
---|
131 | #WITHOUT_MAN=YES # geen handleidingen gecompileerd
|
---|
132 | #WITHOUT_MISC=YES # geen misc sub directory
|
---|
133 | #WITHOUT_MODULES=YES # geen ondersteuning toevoegen modules
|
---|
134 | #WITHOUT_PAM=YES # geen ondersteuning pa modules
|
---|
135 | #WITHOUT_PF=YES # geen packet filtering geinstalleerd
|
---|
136 | #WITHOUT_SHARE=YES # geen share sub directory
|
---|
137 | #WITHOUT_USB=YES # geen ondersteuning usb modules
|
---|
138 | # Specific disabled options
|
---|
139 | WITHOUT_ATM=YES # geen ondersteuning Asynchronous Transfer Mode
|
---|
140 | WITHOUT_AUDIT=YES # geen event auditing / audit trails
|
---|
141 | WITHOUT_AUTHPF=YES # geen authenticating gateway user shell
|
---|
142 | WITHOUT_BLUETOOTH=YES # geen ondersteuning Bluetooth modules
|
---|
143 | WITHOUT_CALENDAR=YES # geen calendar reminder service gecompileerd
|
---|
144 | WITHOUT_CDDL=YES # Set to not build code licensed under Sun CDDL. (also ZFS)
|
---|
145 | WITHOUT_CPP=YES # Set to not build cpp(1).
|
---|
146 | WITHOUT_CVS=YES # geen cvs tools geinstalleerd
|
---|
147 | WITHOUT_DICT=YES # geen dictionary ondersteuning
|
---|
148 | WITHOUT_EXAMPLES=YES # geen voorbeeld configuratiebestanden
|
---|
149 | WITHOUT_FORTRAN=YES # geen ondersteuning fortran compilers
|
---|
150 | WITHOUT_GAMES=YES # geen games gecompileerd
|
---|
151 | WITHOUT_GCOV=YES # geen gcov test coverage program
|
---|
152 | WITHOUT_GDB=YES # geen gnu debugger gecompileerd
|
---|
153 | WITHOUT_GPIB=YES # geen ondersteuning gpib kaarten
|
---|
154 | WITHOUT_HTML=YES # geen html help bestanden gecompileerd
|
---|
155 | WITHOUT_I4B=YES # geen ondersteuning voor isdn
|
---|
156 | WITHOUT_IPX=YES # geen ondersteuning ipx protocols
|
---|
157 | WITHOUT_KERBEROS=YES # geen ondersteuning Kerberos authenticatie
|
---|
158 | WITHOUT_LOCALES=YES # geen ondersteuning lokalisatie
|
---|
159 | WITHOUT_LPR=YES # geen ondersteuning print services
|
---|
160 | WITHOUT_NIS=YES # geen ondersteuning network information system
|
---|
161 | WITHOUT_PROFILE=YES # Set to avoid compiling profiled libraries.
|
---|
162 | WITHOUT_RCMDS=YES # geen ondersteuning rcmds,
|
---|
163 | WITHOUT_RESCUE=YES # geen rescue bestanden gecompileerd
|
---|
164 | WITHOUT_SENDMAIL=YES # geen sendmail geinstalleerd
|
---|
165 | WITHOUT_SHAREDOCS=YES # geen share/docs directories
|
---|
166 | WITHOUT_SYSCONS=YES # geen syscon devices gecompileerd
|
---|
167 | WITHOUT_UNBOUND=YES # Port version will be used if any is used
|
---|
168 | '
|
---|
169 |
|
---|
170 | CONF_BUILD="
|
---|
171 | ${CONF_COMMON}
|
---|
172 | "
|
---|
173 |
|
---|
174 | CONF_INSTALL="
|
---|
175 | ${CONF_COMMON}
|
---|
176 | WITHOUT_TOOLCHAIN=YES # geen freebsd toolchain
|
---|
177 | "
|
---|
178 |
|
---|
179 |
|
---|
180 | # Flash disks arrived, sandisk 1g seems to match the geometry of the (blanc) cards
|
---|
181 | #FlashDevice sandisk 1g # nanobsd flashdevice entry
|
---|
182 | #FlashDevice sandisk 512mb # nanobsd flashdevice entry
|
---|
183 | #FlashDevice transcend 2g # nanobsd flashdevice entry
|
---|
184 | # Calculated value of PEAK hardware 1GB CF card
|
---|
185 | # C/H/S phys 1954/16/63, logical 977/32/63
|
---|
186 | # Mediasize is calculated as C*H*S*512
|
---|
187 |
|
---|
188 | # Using logical values reported by ALIX board
|
---|
189 | # values for PCEngines blanc 1 GB cards
|
---|
190 | # C/H/S phys 1966/16/63, logical 983/32/63
|
---|
191 | NANO_MEDIASIZE=`expr 1008451584 / 512`
|
---|
192 | NANO_HEADS=32
|
---|
193 | NANO_SECTS=63
|
---|
194 |
|
---|
195 |
|
---|
196 | # Version tagging
|
---|
197 | cust_version_tag() (
|
---|
198 | VERSION_FILE="${NANO_WORLDDIR}/tools/wl-release.txt"
|
---|
199 | (
|
---|
200 | echo "Generated by `id -un`@`hostname -f` at `date`"
|
---|
201 | echo ""
|
---|
202 | echo "=== CONFIG specifics ==="
|
---|
203 | svn info ${NANO_CONF_DIR}/../ || exit 0
|
---|
204 | svn diff ${NANO_CONF_DIR}/../ || exit 0
|
---|
205 | echo "=== BEGIN CONFIG specifics ==="
|
---|
206 | ) > $VERSION_FILE
|
---|
207 | )
|
---|
208 |
|
---|
209 | # Takes a very long time (10+) minutes to generate this file on an ALIX board,
|
---|
210 | # not practical for quick debugging and configuration.
|
---|
211 | cust_openvpn_dhparam() (
|
---|
212 | DHFILE=${NANO_WORLDDIR}/etc/easy-rsa-keys/dh1024.pem
|
---|
213 | mkdir -p `dirname $DHFILE`
|
---|
214 | openssl dhparam -out $DHFILE 1024
|
---|
215 | )
|
---|
216 |
|
---|
217 |
|
---|
218 |
|
---|
219 | # Assuming we are running a safe envirionment where snooping could occur during or after the build
|
---|
220 | cust_set_root_password() (
|
---|
221 | if [ -n "${CFG_ROOT_PASSWORD}" ]; then
|
---|
222 | pprint 2 "Set root password using CFG_ROOT_PASSWORD variable"
|
---|
223 | chroot ${NANO_WORLDDIR} sh -c "echo '${CFG_ROOT_PASSWORD}' | pw usermod -h 0 -n root"
|
---|
224 | else
|
---|
225 | pprint 2 "Root password is <blank>, no password provided at variable CFG_ROOT_PASSWORD"
|
---|
226 | fi
|
---|
227 | )
|
---|
228 |
|
---|
229 |
|
---|
230 |
|
---|
231 | # EXPERIMENTAL patch like envirionment
|
---|
232 | # Using '*-nanobsd.patch' files to only specify the bare differences between the base/default file to
|
---|
233 | # keep us as close as possible to the base OS
|
---|
234 | # Patches are applied to the directory they live in
|
---|
235 | #cust_apply_nanobsd_patches() (
|
---|
236 | # for PATCHFILE in `find ${NANO_WORLDDIR} -regex '.*-nanobsd\.patch$'`; do
|
---|
237 | # cd `dirname ${PATCHFILE}`
|
---|
238 | # patch -t -N -p0 -i `basename ${PATCHFILE}`
|
---|
239 | # #XX: What to with installed patch files? Delete them for the time beeing
|
---|
240 | # rm -v ${PATCHFILE}
|
---|
241 | #done
|
---|
242 |
|
---|
243 |
|
---|
244 |
|
---|
245 | #)
|
---|
246 |
|
---|
247 |
|
---|
248 |
|
---|
249 | # Customize ntpd
|
---|
250 | cust_ntpd() (
|
---|
251 | chroot ${NANO_WORLDDIR} sh -c "ln -fs /usr/local/etc/ntp.drift /var/db/ntp.drift"
|
---|
252 | )
|
---|
253 |
|
---|
254 |
|
---|
255 | # Enable Serial TTYs
|
---|
256 | cust_serial_ttys() (
|
---|
257 | chroot ${NANO_WORLDDIR} sed -i '' -e '/ttyv[0-9]/s/on /off/' -e '/ttyu0/s/off/on/' -e '/ttyu0/s/dialup/ansi/' /etc/ttys
|
---|
258 |
|
---|
259 | # Serial login is consided to be phycically secured, so no credentials are required
|
---|
260 | chroot ${NANO_WORLDDIR} sed -i '' -e '/ttyu0/s/std.9600/al.9600/' /etc/ttys
|
---|
261 | )
|
---|
262 |
|
---|
263 | # Customize sudoers files
|
---|
264 | cust_sudo_rules() {
|
---|
265 | chroot ${NANO_WORLDDIR} find /usr/local/etc/sudoers.d/ -type f -exec chmod 0640 {} \+
|
---|
266 | }
|
---|
267 |
|
---|
268 |
|
---|
269 |
|
---|
270 | # Install files from specific relative location
|
---|
271 | cust_install_files () (
|
---|
272 | cd ${NANO_CONF_DIR}/../files
|
---|
273 | find . -print | grep -v -e /CVS -e .svn | cpio -dumpv ${NANO_WORLDDIR}
|
---|
274 | )
|
---|
275 |
|
---|
276 |
|
---|
277 | # Make tools available for root by default
|
---|
278 | cust_root_bin_to_tools() {
|
---|
279 | ln -s /tools ${NANO_WORLDDIR}/root/bin
|
---|
280 | }
|
---|
281 |
|
---|
282 |
|
---|
283 | # Prune no needed directories of image
|
---|
284 | cust_nano_prune () (
|
---|
285 | cd ${NANO_WORLDDIR}
|
---|
286 | for ENTRY in ${NANO_PRUNE}; do
|
---|
287 | rm -vfR ${ENTRY}
|
---|
288 | done
|
---|
289 | )
|
---|
290 |
|
---|
291 | # We actually do need an seperate /tmp, so undo the symlinking done in
|
---|
292 | # setup_nanobsd()
|
---|
293 | late_cust_unset_common_var_and_tmp() (
|
---|
294 | cd ${NANO_WORLDDIR}
|
---|
295 | rm tmp
|
---|
296 | mkdir -m 1777 tmp
|
---|
297 | )
|
---|
298 |
|
---|
299 |
|
---|
300 | # Fill /cfg wmth custom files, based on 'create_i386_diskimage ( )'
|
---|
301 | last_nano_fill_cfg () (
|
---|
302 | # Variables to be used
|
---|
303 | IMG=${NANO_DISKIMGDIR}/${NANO_IMGNAME}
|
---|
304 | MNT=${MAKEOBJDIRPREFIX}/_.mnt
|
---|
305 |
|
---|
306 | # Mount '/cfg' slize in image
|
---|
307 | MD=`mdconfig -a -t vnode -f ${IMG}`
|
---|
308 | mount /dev/${MD}s3 ${MNT}
|
---|
309 |
|
---|
310 | # Location of '/cfg' directory
|
---|
311 | cd ${NANO_CONF_DIR}/../cfg-files
|
---|
312 | find . -print | grep -v -e /CVS -e .svn | cpio -dumpv ${MNT}
|
---|
313 |
|
---|
314 |
|
---|
315 | # Leave in nice end state
|
---|
316 | umount ${MNT}
|
---|
317 | mdconfig -d -u ${MD}
|
---|
318 | ) > ${MAKEOBJDIRPREFIX}/_.fc 2>&1
|
---|
319 |
|
---|
320 | last_nano_disk_usage () (
|
---|
321 | # Variables to be used
|
---|
322 | IMG=${NANO_DISKIMGDIR}/${NANO_IMGNAME}
|
---|
323 | MNT=${MAKEOBJDIRPREFIX}/_.mnt
|
---|
324 |
|
---|
325 | # Mount root slize
|
---|
326 | MD=`mdconfig -a -t vnode -f ${IMG}`
|
---|
327 | mount /dev/${MD}s1a ${MNT}
|
---|
328 |
|
---|
329 | # Show disk usage (percent free) inc header
|
---|
330 | pprint 2 $(df -h | head -1)
|
---|
331 | pprint 2 "$(df -h | grep /dev/${MD})"
|
---|
332 |
|
---|
333 | # Leave in nice end state
|
---|
334 | umount ${MNT}
|
---|
335 | mdconfig -d -u ${MD}
|
---|
336 | )
|
---|
337 |
|
---|
338 | last_orders () (
|
---|
339 | last_nano_fill_cfg
|
---|
340 | last_nano_disk_usage
|
---|
341 | )
|
---|
342 |
|
---|
343 | # Ugly hack to 'escaping' pprint from inside a customize_cmd to output
|
---|
344 | # instead of a file
|
---|
345 | exec 3>/dev/stdout
|
---|
346 | # Progress Print
|
---|
347 | # Print $2 at level $1
|
---|
348 | pprint() {
|
---|
349 | if [ "$1" -le $PPLEVEL ]; then
|
---|
350 | printf "%.${1}s %s\n" "#####" "$2" 1>&3
|
---|
351 | fi
|
---|
352 | }
|
---|
353 |
|
---|
354 | # Cust macro`s gestart in onderstaande volgorde
|
---|
355 | # XXX: Determine size before installing all find of additions to see how much
|
---|
356 | # base we are actually using ## du -h -d 0
|
---|
357 | customize_cmd cust_pkgng
|
---|
358 | customize_cmd cust_install_files
|
---|
359 | customize_cmd cust_ntpd
|
---|
360 | customize_cmd cust_serial_ttys
|
---|
361 | customize_cmd cust_version_tag
|
---|
362 | customize_cmd cust_root_bin_to_tools
|
---|
363 | customize_cmd cust_allow_ssh_root
|
---|
364 | customize_cmd cust_openvpn_dhparam
|
---|
365 | customize_cmd cust_nano_prune
|
---|
366 | customize_cmd cust_set_root_password
|
---|
367 | customize_cmd cust_sudo_rules
|
---|
368 | #customize_cmd cust_apply_nanobsd_patches
|
---|
369 | late_customize_cmd late_cust_unset_common_var_and_tmp
|
---|
370 |
|
---|
371 | # Standard overwrite
|
---|
372 | if [ -r "$NANO_CONF_DIR/nanobsd.local" ]; then
|
---|
373 | . $NANO_CONF_DIR/nanobsd.local
|
---|
374 | fi
|
---|
375 |
|
---|
376 | # Extra config if existing is not suffient
|
---|
377 | if [ -n "$EXTRA_NANOBSD_CONFIG" ]; then
|
---|
378 | for FILE in $EXTRA_NANOBSD_CONFIG; do
|
---|
379 | # File relative to config directory
|
---|
380 | if [ "`echo $FILE | cut -c1`" != "/" ]; then
|
---|
381 | FILE=$NANO_CONF_DIR/$FILE
|
---|
382 | fi
|
---|
383 | pprint 1 "Loading $FILE"
|
---|
384 | . $FILE || exit 1
|
---|
385 | done
|
---|
386 | fi
|
---|