o
    Y7e =                  	   @   s   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZe Z	e	j
Z
e	jZejdi eje je	jdZejZejZejZdZdd Zdd Zdd	 Zd
d Zdd Zdd Zdd Z dddZ!dS )    Nzrollout_conf.pyz.in.pyc                     s   t jtjdfdd} |  D ]\} tdt j|   tr>tj	
t j|  dtt   t}n} fdd}t j|||d}t jt||d	}td
d|gddddj}i i d}sw|jd i t}rdv rd |t|}rt|trdv rdd d D }g }	|dD ]}
|D ]\}}||
dur|	|  nq|	|
 qd|	}t jt|}tdd|g ||d u rtdd|g q||d u rtd
d||d gdd qtd
d|g|dtjd qdS )!zc
    Walk through configuration templates and adjust configs in target system
    accordingly.
    	templatesc                  3   sd    t  D ])\} }}d| v rq| t d d } |D ]}|dr)|dr)q| |fV  qqdS )z
        Walk through templates directory, yielding tuples of (folder, filename)
        for configuration or source files, excluding any pycache or swap files.
        __pycache__   N.z.swp)oswalklen
startswithendswith)folderdirsfilesfilename)r    R/home/thorsten/Data/Arbeit/PerFact/Git/ema-modules/MigrationMonster/bin/rollout.py_walk_templates&   s   z configs.<locals>._walk_templateszProcessing config template: Nc                    s$   | d }r|v r| t S  S )zpReturns filename, but if the module defines an overriding
            function, call that and return its result.	_filename)config)prefixfunc)r   modifymoduler   r   _fnameB   s   zconfigs.<locals>._fnamesrctgtsudocatTF)textcapture_outputcheck)removerenamegeneraterulesc                 S   s.   g | ]}t |d  |d jdi tfqS )r   r   r   )recompileformatr   ).0itemr   r   r   
<listcomp>m   s    &zconfigs.<locals>.<listcomp>
mkdirz-pr    rm-fr!   mvz	.disabledr   teeinputr   stdoutr   )r   pathjoinenvconfig_pathprintr
   RULES_SUFFIXperfactgenericload_configr   
mount_path_runr3   r&   r   
isinstancestrsplitsearchappend_sudo
subprocessDEVNULL)r   r   src_dirr   src_filenametgt_filenamecontentsignalsr#   resultlinerulereplacement
tgt_folderr   )r   r   r   r   r   configs   sx   
		


rQ   c                  C   s   t ddstd dS dg} g d|  }|D ]^}tjt|dd d}tj|s1td	| qtd
| tdd|g ddtg}|| v rM|	g d |	dd|g dgg dddgg ddgg dg}|D ]}t
|| tjd qiqdS )zO
    Re-initialize git-repositories on the target system. Requires chroot.
    reset_git_reposTz7Skipping reset of git histories as requested in config.Nz/opt/perfact/dbutils-pgrepo)z/etcz/var/lib/zope2.13z/var/lib/zope4r   z.gitzPath of git repo does not existzResetting git repor,   z-rr   chroot)r   -ur:   git-Cinit)r   gc.auto0addr   )commit-mzInitial commitgc)r   rX   1)r3   )r   getr8   r   r4   r5   r=   existsrD   extendr>   rE   rF   )repos_perfactreposrepor4   
cmd_prefixcmdscmdr   r   r   rR      s<   


rR   c                  C   sL  t  tjtd} t| rtdd|  tdg|   d}tg dddd	 j	d	k}d
dgg dddddddddddj
dDi tg
ddddddddddddj
dDi tddgddddddddddddj
dDi tddgg}td r|g d! |ddddddddddddj
dDi tdd"g |g d# |g d$ |r|d% d& |dddddj
dDi tdddddd&g |g d' |g d( d)}t|  i }d*D ]}tjdd+tjt|d,gd-d-d-d.j||< qtjdd/tjtd0gd1|d2  d-tjd3 tjdd/tjtd4gd5d6d7 | D d-tjd3 ttjtd8}d9|   d:d; }t| W d:   n	1 sKw   Y  tjtd<}tjdd/|gd=| d-tjd-d> tjddd?d|gd-d tjdd+tjt|gd-d@}ttjtdAdB}t||dC W d:   d:S 1 sw   Y  d:S )Ea  
    Renew keys. This includes:
    * SSH server key
    * SSH private keys of root, perfact, phonehome, zope and mpr (which
      is a second key belonging to zope)
    This will also output the public key for phonehome to be entered on the
    perfact phonehome server.
    zetc/ssh/ssh_host_*Removingz,
    r,   zhome/zope/.ssh/id_rsa.pub)testr-   /etc/perfact/phonehome/id_rsaFr/   r   zdpkg-reconfigurezopenssh-server)r,   r-   z/root/.ssh/id_rsaz/root/.ssh/id_rsa.pub/home/zope/.ssh/id_rsaz/home/zope/.ssh/id_rsa.pub/home/perfact/.ssh/id_rsaz/home/perfact/.ssh/id_rsa.pubz
ssh-keygenz-f/root/.ssh/id_rsaz-trsaz-b4096z-N rV   zroot@{systemname}r   rT   r:   zperfact@{systemname}r-   rl   zopezzope@{systemname}rk   mpa_mpr_maintenance_keygen)r,   r-   /home/zope/.ssh/mpr-id_rsaz/home/zope/.ssh/mpr-id_rsa.pubz"/home/mpaproxy/.ssh/mpr-id_rsa.pubrr   )r   cprr   /home/mpaproxy/.ssh/mpr-id_rsa)r   chownmpaproxyrt   r   rj   )ru   pfphonehomerj   !/etc/perfact/phonehome/id_rsa.pub)chgrprw   rj   rx   z etc/perfact/phonehome/id_rsa.pub)rootz	home/zoper   z.ssh/id_rsa.pubT)r   r   r   r0   zroot/.ssh/authorized_keyszfrom="127.0.0.1" rz   r1   z"home/mpaproxy/.ssh/authorized_keysr*   c                 S   s   g | ]}d  |qS )zfrom="127.0.0.1" {}r&   )r'   keyr   r   r   r)   .  s    zssh_keys.<locals>.<listcomp>z etc/ssh/ssh_host_ed25519_key.pub N   zroot/.ssh/known_hostsz
localhost )r2   r   r3   r   z-H)r   zphonehome.pubwfiler   )globr   r4   r5   r=   r   r8   rD   _chroot_cmds
returncoder&   r   r_   rC   rE   runr3   rF   valuesopenreadstriprA   check_output
build_path)keysphonehome_pubkeypathnew_phonehomecommandspubkeyr4   fknown_hostsr   r   r   ssh_keys   s   





$r   c                   C   s0   t d sdS tjddtddgt d  dd dS )	zE
    Disable services by default according to the configuration.
    disable_servicesNr   rS   	systemctldisableTr/   )r   rE   r   r=   r   r   r   r   servicesS  s   
r   c                  C   s   t dsd S tjddtdddgt d  tjd} ttj	t
dd	}| jD ]}t| t||d
 q'W d    n1 s>w   Y  |   d S )Npurge_packagesr   rS   zapt-getpurgez-y)stderrzapt-errors.logr   r   )r   r_   rE   Popenr=   PIPEr   r   r4   r5   r   r   r8   wait)procr   rM   r   r   r   packages_purgeb  s"   

r   c               
      s  t d sdS ttjtdd} tt d | d dd d	D  tjd
dt	dgd fddd	D ddd d	D ]}td
| | | d q8d
t dd}tjd
dt	d
dd|dgtjddd}t|j}|d  td
 d | d |   g d}|D ]"\}}| vrqtdtjt	d
|gtjdd
| | d  qtjt	d!}td|gtjd|d" d  tg d#tjd$d% dS )&zE
    Generate random passwords and write them to build/passwords
    randomize_passwordsN	passwordsr   
systemnamer   c                 S   s   i | ]}|t jjd ddqS )   :abcdefghijklmnopqrstuvwxABCDEFGHIJKLMNOPQRSTUVWX0123456789)lengthvalid_chars)r:   r;   generate_random_stringr'   userr   r   r   
<dictcomp>  s    	zpasswords.<locals>.<dictcomp>)rz   maintr   rS   chpasswdr*   c                    s   g | ]
}d  | | qS )z{}:{}r{   r   pwr   r   r)     s    zpasswords.<locals>.<listcomp>T)r2   r   universal_newlinesz{}@ubuntu: {}z$/usr/share/perfact/zope{}/bin/pythonzope_versionz2,13rT   rp   z6/opt/perfact/migration/src/inchroot/zope-modify-passwd)r3   r   r   zperfact@zope: {}r:   ))assignassign_worker)cronr   )cachetriggerr   r0   zroot/.netrc-{}z&machine localhost login {} password {})r3   r   r2   z8opt/perfact/dbutils-zoperepo/__root__/acl_users/__meta__metafile)
r   rT   r:   rU   rV   z/opt/perfact/dbutils-zoperepor[   z-ar\   zUpdate passwordsF)r3   r   )r   r   r   r4   r5   r   r8   rE   r   r=   r&   r_   r   jsonloadsr3   closerD   rF   r   )outfiler   interpreterr   datanetrc_filesfnamer   r   r   r   r   s  sx   	

		
r   c                   C   s2   t g dg dg dg dddddtd	 g d
S )zJ
    Call script in chroot to regenerate the HAProxy SSL certificate.
    )bashz-cz"chown zope:zope /etc/haproxy/ssl/*)ru   zroot:haproxy/etc/haproxy/ssl)chmodzg+rwxr   )r   zo-rwxr   r   rT   rp   z6/opt/perfact/migration/src/inchroot/haproxy-renew-certcert_subjectN)r   r   r   r   r   r   ssl_cert  s   r   c                 C   sF   | du rdg} t | ts| g} | D ]}tjddtdd|gdd qdS )z?
    Rebuild the mapping files for postfix (using postmap)
    Nz/etc/postfix/transport_closedr   rS   z/usr/sbin/postmapTr/   )r?   listrE   r   r=   )r   r4   r   r   r   postfix_postmap  s   
r   r   )N)"r   r$   rE   r   r   perfact.genericr:   helpers
create_envr6   r   r=   	Namespacer;   r<   r4   r5   r7   r   r   r>   r   rD   chroot_cmdsr   r9   rQ   rR   r   r   r   r   r   r   r   r   r   r   <module>   s8   p* a