Create database tablespace stubs on fritz
[clinton/scripts.git] / create-user
CommitLineData
d2462e94 1#!/bin/bash -ex
2
3# MUST be executed:
4# - on deleuze
5# - as a user with an /etc/sudoers line
64f69c08 6# - member of "wheel" unix group on deleuze
78725790 7# - while holding tickets for a user who can 'ssh -K' to mire
64f69c08 8# - and is a member of "wheel" on mire
d2462e94 9# - while holding tokens for a user who is:
10# - a member of system:administrator
11# - listed in 'bos listusers deleuze'
241a0263 12# - and who has been set up with Domtool admin privileges by:
13# - running 'domtool-adduser $USER' while holding AFS admin tokens as
14# someone who is already a Domtool admin
15# - running 'domtool-admin grant $USER priv all' as someone who is already a
16# Domtool admin
17# (To bootstrap yourself into admindom:
18# 1. Run '/etc/init.d/domtool-server stop' on deleuze.
19# 2. Run '/etc/init.d/domtool-slave stop' on all Domtool slave machines
20# (e.g., mire).
21# 3. Edit ~domtool/acl, following the example of adamc_admin to grant
22# yourself 'priv all'.
23# 4. Run '/etc/init.d/domtool-server start' on deleuze.
24# 5. Run '/etc/init.d/domtool-slave start' on all Domtool slave
25# machines.
26# 6. Run 'domtool-adduser' as above.)
d2462e94 27
28USER=$1
29
cd0db70e 30export PATH=$PATH:/afs/hcoop.net/common/bin/
31
d2462e94 32if test -z "$USER"; then
33 echo "Invoke as create-user <USERNAME>"
34 exit 1
35fi
36
7e1859cd 37#
38# Helper functions
39#
40
41# Run a command on both mire and deleuze; assumes that no escaping is
42# needed.
43function mire_and_deleuze() {
44 $*
45 ssh mire.hcoop.net $*
46}
d2462e94 47
82cda9f8
CE
48function execute_on_fritz () {
49 ssh fritz.hcoop.net $*
50}
51
52function execute_on_all_machines () {
53 $*
54 ssh mire.hcoop.net $*
55 ssh hopper.hcoop.net $*
56 ssh fritz.hcoop.net $*
57}
58
d2462e94 59#
60# Kerberos principals
61# (creat kerberos principals: fred, fred/cgi, fred/mailfilter)
62#
63
64# We use -randkey for user's main principal as well, to make sure that
65# the creation process does not continue without having a main
66# principal. (But you who want to set password for a user, don't
67# worry - we'll invoke cpw later, so that it has the same effect
68# as setting password right now - while it is more error tolerant).
69
52e2a5b3 70sudo kadmin.local -p root/admin -q "ank -policy user -randkey +requires_preauth $USER@HCOOP.NET"
cd0db70e 71sudo kadmin.local -p root/admin -q "modprinc -maxlife 1day $USER@HCOOP.NET"
72sudo kadmin.local -p root/admin -q "ank -policy daemon -randkey +requires_preauth $USER/daemon@HCOOP.NET"
d2462e94 73
74#
75# Create AFS users corresponding to krb5 principals.
76# (fred/cgi principal == fred.cgi AFS user)
77#
78
79pts cu $USER || true
80ID=`pts examine $USER | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'`
cd0db70e 81pts cu $USER.daemon || true
82ID_DAEMON=`pts examine $USER.daemon | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'`
d2462e94 83
84
85#
86# Construct various paths for later perusal.
87#
88
89# (If it's not clear, for user fred, PATHBITS = f/fr/fred)
90PATHBITS=`echo $USER | head -c 1`/`echo $USER | head -c 2`/$USER
91HOMEPATH=/afs/hcoop.net/user/$PATHBITS
92MAILPATH=/afs/hcoop.net/common/email/$PATHBITS
d2462e94 93
94#
95# Create LDAP entries. (With the whole libnss-ptdb, I kind of
96# lost the idea of what I want to do with LDAP, but we'll
97# see with time how well it integrates...)
98# The ID returned from AFS is important here, we want to make
99# sure those IDs match.
100#
101
102# USER entry
103echo "
104dn: uid=$USER,ou=People,dc=hcoop,dc=net
105objectClass: top
106objectClass: person
107objectClass: posixAccount
108cn: $USER
109uid: $USER
110gidNumber: $ID
d2462e94 111sn: $USER
112host: abulafia
113host: mire
114
115dn: cn=$USER,ou=Group,dc=hcoop,dc=net
116objectClass: top
117objectClass: posixGroup
118cn: $USER
119gidNumber: $ID
120memberUid: $USER
0963ebc5 121" | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true
d2462e94 122
cd0db70e 123# USER.daemon entry
d2462e94 124echo "
cd0db70e 125dn: uid=$USER.daemon,ou=People,dc=hcoop,dc=net
d2462e94 126objectClass: top
127objectClass: person
128objectClass: posixAccount
cd0db70e 129cn: $USER.daemon
130uid: $USER.daemon
131gidNumber: $ID_DAEMON
132sn: $USER.daemon
d2462e94 133
cd0db70e 134dn: cn=$USER.daemon,ou=Group,dc=hcoop,dc=net
d2462e94 135objectClass: top
136objectClass: posixGroup
cd0db70e 137cn: $USER.daemon
138gidNumber: $ID_DAEMON
139memberUid: $USER.daemon
0963ebc5 140" | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true
d2462e94 141
142
143#
144# Export .mailfilter and .cgi keys to a keytab file
145#
146
cd0db70e 147# create a daemon keytab (used by /etc/exim4/get-token)
148# *only* if it does not exist!
149test -e /etc/keytabs/user.daemon/$USER || \
150 sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/user.daemon/$USER $USER/daemon@HCOOP.NET"
d2462e94 151
cd0db70e 152# Properly chown/mod keytab files (must be $USER:www-data)
153sudo chown $USER:www-data /etc/keytabs/user.daemon/$USER
154sudo chmod 440 /etc/keytabs/user.daemon/$USER
d2462e94 155
3a9bd77a 156# rsync keytabs
cd0db70e 157(cd /etc/keytabs
158 sudo tar clpf - user.daemon/$USER | \
159 ssh mire.hcoop.net cd /etc/keytabs\; sudo tar xlpf -)
3a9bd77a
CE
160(cd /etc/keytabs
161 sudo tar clpf - user.daemon/$USER | \
162 ssh hopper.hcoop.net cd /etc/keytabs\; sudo tar xlpf -)
d2462e94 163
164#
165# Create/mount/set-perms on user's volumes (home, mail, databases, logs)
166#
167
168# HOME VOLUME
3a9bd77a
CE
169if vos examine user.$USER.d 2>/dev/null; then
170 echo "Reactivating old volume (user.$USER.d)"
171 vos rename user.$USER.d user.$USER
172fi
0963ebc5 173vos examine user.$USER 2>/dev/null || \
174 vos create deleuze.hcoop.net /vicepa user.$USER -maxquota 400000
3a9bd77a 175
d2462e94 176mkdir -p `dirname $HOMEPATH`
3304c1fa 177fs ls $HOMEPATH || test -L $HOMEPATH || fs mkm $HOMEPATH user.$USER
b7b1cdff 178chown $USER:nogroup $HOMEPATH
d2462e94 179fs sa $HOMEPATH $USER all
cd0db70e 180fs sa $HOMEPATH system:anyuser l
d2462e94 181
182# Apache logs
655b4c82 183mkdir -p $HOMEPATH/.logs
184chown $USER:nogroup $HOMEPATH/.logs
185mkdir -p $HOMEPATH/.logs/apache
186chown $USER:nogroup $HOMEPATH/.logs/apache
187fs sa $HOMEPATH/.logs/apache $USER.daemon rlwidk
188mkdir -p $HOMEPATH/.logs/mail
189fs sa $HOMEPATH/.logs/mail $USER.daemon rlwidk
190chown $USER:nogroup $HOMEPATH/.logs/mail
d2462e94 191
7a7e31c9 192# public_html
42d22a10 193test -e $HOMEPATH/public_html || \
194 (mkdir -p $HOMEPATH/public_html; \
195 chown $USER:nogroup $HOMEPATH/public_html; \
196 fs sa $HOMEPATH/public_html system:anyuser none; \
197 fs sa $HOMEPATH/public_html $USER.daemon rl)
b7b1cdff 198
199# .procmail.d
200mkdir -p $HOMEPATH/.procmail.d
201chown $USER:nogroup $HOMEPATH/.procmail.d
202fs sa $HOMEPATH/.procmail.d system:anyuser rl
203
204# .public
cd0db70e 205mkdir -p $HOMEPATH/.public/
b7b1cdff 206chown $USER:nogroup $HOMEPATH/.public
207fs sa $HOMEPATH/.public system:anyuser rl
208
209# .domtool
210mkdir -p $HOMEPATH/.public/.domtool
211chown $USER:nogroup $HOMEPATH/.public/.domtool
cd0db70e 212test -e $HOMEPATH/.domtool || \
213 test -L $HOMEPATH/.domtool || \
74e97319 214 sudo -u $USER ln -s $HOMEPATH/.public/.domtool $HOMEPATH/.domtool
7a7e31c9 215
0008b2c9 216# Gitweb hosting
d890ae7b 217test -L /var/cache/git/$USER || \
218 sudo ln -s $HOMEPATH/.hcoop-git /var/cache/git/$USER
0008b2c9 219
d2462e94 220# MAIL VOLUME
3a9bd77a
CE
221if vos examine mail.$USER.d 2>/dev/null; then
222 echo "Reactivating old volume (mail.$USER.d)"
223 vos rename mail.$USER.d mail.$USER
224fi
0963ebc5 225vos examine mail.$USER 2>/dev/null || \
226 vos create deleuze.hcoop.net /vicepa mail.$USER -maxquota 400000
3a9bd77a 227
d2462e94 228mkdir -p `dirname $MAILPATH`
ef64fd5f 229fs ls $MAILPATH || fs mkm $MAILPATH mail.$USER
230fs ls $HOMEPATH/Maildir || fs mkm $HOMEPATH/Maildir mail.$USER
894794d2 231chown $USER:nogroup $MAILPATH
232chown $USER:nogroup $HOMEPATH/Maildir
cd0db70e 233fs sa $MAILPATH $USER all
ea773cea 234fs sa $MAILPATH $USER.daemon all
739364a2 235if test ! -e $MAILPATH/new; then
236 mkdir -p $MAILPATH/cur $MAILPATH/new $MAILPATH/tmp
237 echo -e "This email account is provided as a service for HCoop members." \
238 "\n\nTo learn how to use it, please visit the page" \
ffff3a6f 239 "\n<http://wiki.hcoop.net/MemberManual/Email> on our website."| \
739364a2 240 mail -s "Welcome to your HCoop email store" \
241 -e -a "From: postmaster@hcoop.net" \
242 real-$USER
243fi
3d7737ab 244chown $USER:nogroup $MAILPATH/cur $MAILPATH/new $MAILPATH/tmp
d2462e94 245
64a96d98 246# Set up shared SpamAssassin folder
247if test -f $HOMEPATH/Maildir/shared-maildirs; then
248 # Deal with case where user rsync'd their Maildir from fyodor
249 pattern='^SpamAssassin /home/spamd'
250 file=$HOMEPATH/Maildir/shared-maildirs
251 if grep $pattern $file; then
252 sed -i -r -e \
253 's!^(SpamAssassin )/home/spamd!\1/var/local/lib/spamd!1' \
254 $file
255 fi
64a96d98 256else
257 maildirmake --add SpamAssassin=/var/local/lib/spamd/Maildir \
258 $HOMEPATH/Maildir
259fi
260
82cda9f8
CE
261# Create database tablespaces
262execute_on_fritz /afs/hcoop.net/common/etc/scripts/create-user-database $PATHBITS
d2462e94 263
264#
265# Mount points for backup volumes
266#
267
cd0db70e 268mkdir -p `dirname /afs/hcoop.net/.old/user/$PATHBITS`
269mkdir -p `dirname /afs/hcoop.net/.old/mail/$PATHBITS`
270fs ls /afs/hcoop.net/.old/user/$PATHBITS || \
271 fs mkm /afs/hcoop.net/.old/user/$PATHBITS user.$USER.backup
272fs ls /afs/hcoop.net/.old/mail/$PATHBITS || \
273 fs mkm /afs/hcoop.net/.old/mail/$PATHBITS mail.$USER.backup
274vos release old
d2462e94 275
7fe272af 276# technically this might not be necessary, but for good measure...
d2462e94 277vos syncserv deleuze
278vos syncvldb deleuze
7fe272af 279
280# refresh volume location cache (takes ~2hrs otherwise)
7e1859cd 281mire_and_deleuze fs checkvolumes
2c556c0c 282
283#
7e1859cd 284# Non-AFS files and directories
2c556c0c 285#
286
da0bc057 287# Make per-user apache DAV lock directory -- the directory must be
288# both user and group-writable, which is silly.
7e1859cd 289mire_and_deleuze sudo mkdir -p /var/lock/apache2/dav/$USER
290mire_and_deleuze sudo chown $USER:www-data /var/lock/apache2/dav/$USER
291mire_and_deleuze sudo chmod ug=rwx,o= /var/lock/apache2/dav/$USER
db51e5b7 292
293#
294# Domtool integration
295#
296
297domtool-adduser $USER
2a2fcc8e 298
299#
300# Subscribe user to our mailing lists.
301#
302echo $USER@hcoop.net | sudo -u list \
303 /var/lib/mailman/bin/add_members -r - hcoop-announce