#!/bin/bash

#
# template script for generating suse container for LXC
#

#
# lxc: linux Container library

# Authors:
# Daniel Lezcano <daniel.lezcano@free.fr>
# Frederic Crozat <fcrozat@suse.com>

# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.

# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# Lesser General Public License for more details.

# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA

configure_sles()
{
    rootfs=$1
    hostname=$2

   # set network as static, but everything is done by LXC outside the container
   cat <<EOF > $rootfs/etc/sysconfig/network/ifcfg-eth0
STARTMODE='auto'
BOOTPROTO='none'
EOF

   # create empty fstab
   touch $rootfs/etc/fstab
   ln -s -f /proc/self/mounts $rootfs/etc/mtab

    # create minimal /dev
    mknod -m 666 $rootfs/dev/random c 1 8
    mknod -m 666 $rootfs/dev/urandom c 1 9
    mkdir -m 755 $rootfs/dev/pts
    mkdir -m 1777 $rootfs/dev/shm
    mknod -m 666 $rootfs/dev/tty c 5 0
    mknod -m 600 $rootfs/dev/console c 5 1
    mknod -m 666 $rootfs/dev/tty0 c 4 0
    mknod -m 666 $rootfs/dev/tty1 c 4 1
    mknod -m 666 $rootfs/dev/tty2 c 4 2
    mknod -m 666 $rootfs/dev/tty3 c 4 3
    mknod -m 666 $rootfs/dev/tty4 c 4 4
    ln -s null $rootfs/dev/tty10
    mknod -m 666 $rootfs/dev/full c 1 7
    mknod -m 666 $rootfs/dev/ptmx c 5 2
    ln -s /proc/self/fd $rootfs/dev/fd
    ln -s /proc/kcore $rootfs/dev/core
    mkdir -m 755 $rootfs/dev/net
    mknod -m 666 $rootfs/dev/net/tun c 10 200

    # set the hostname
    cat <<EOF > $rootfs/etc/HOSTNAME
$hostname
EOF
    # ensure /etc/hostname is available too
    ln -s -f HOSTNAME $rootfs/etc/hostname

    # do not use hostname from HOSTNAME variable
    cat <<EOF >> $rootfs/etc/sysconfig/cron
unset HOSTNAME
EOF

    # set minimal hosts
    cat <<EOF > $rootfs/etc/hosts
127.0.0.1 localhost $hostname
EOF

    # disable various services
    # disable yast->bootloader in container
    cat <<EOF > $rootfs/etc/sysconfig/bootloader
LOADER_TYPE=none
LOADER_LOCATION=none
EOF

    # cut down inittab
    cat <<EOF > $rootfs/etc/inittab
id:3:initdefault:
si::bootwait:/etc/init.d/boot
l0:0:wait:/etc/init.d/rc 0
l1:1:wait:/etc/init.d/rc 1
l2:2:wait:/etc/init.d/rc 2
l3:3:wait:/etc/init.d/rc 3
l6:6:wait:/etc/init.d/rc 6
ls:S:wait:/etc/init.d/rc S
~~:S:respawn:/sbin/sulogin
p6::ctrlaltdel:/sbin/init 6
p0::powerfail:/sbin/init 0
cons:2345:respawn:/sbin/mingetty --noclear console screen
c1:2345:respawn:/sbin/mingetty --noclear tty1 screen
EOF

   # set /dev/console as securetty
   cat << EOF >> $rootfs/etc/securetty
console
EOF

    cat <<EOF >> $rootfs/etc/sysconfig/boot
# disable root fsck
ROOTFS_FSCK="0"
ROOTFS_BLKDEV="/dev/null"
EOF

    # configure suseregister
    username=`sed -e '/username=/!d' -e 's/username=\(.*\)$/\1/' /etc/zypp/credentials.d/NCCcredentials`
    if [ -n $username ]; then
     echo "hostGUID=$username" >> $rootfs/etc/suseRegister.conf
    fi

    # remove pointless services in a container
    for service in boot.udev boot.udev_retry boot.md boot.lvm boot.loadmodules boot.device-mapper boot.clock boot.swap haldaemon boot.klog; do
        $rootfs/sbin/insserv -r -f -p $rootfs/etc/init.d $service
    done

    # copy /etc/localtime from host to have correct time in container
    if [ -e /etc/localtime ]; then
        cp /etc/localtime $rootfs/etc/localtime
    fi

    echo "Please change root-password !"
    echo "root:root" | chroot $rootfs chpasswd

    return 0
}

download_sles()
{
    cache=$1
    arch=$2

    # check the mini sles was not already downloaded
    mkdir -p "$cache/partial-$arch"
    
    if [ $? -ne 0 ]; then
	echo "Failed to create '$cache/partial-$arch' directory"
	return 1
    fi
 
    # download a mini sles into a cache
    echo "Downloading sles minimal ..."
    mkdir -p "$cache/partial-$arch/dev"
    mknod -m 666 $cache/partial-$arch/dev/null c 1 3
    mknod -m 666 $cache/partial-$arch/dev/zero c 1 5
    # copy host sles configuration in guest
    mkdir -p $cache/partial-$arch/etc/
    cp -ra /etc/zypp $cache/partial-$arch/etc/
    cp -ra /etc/products.d $cache/partial-$arch/etc/
    zypper --quiet --gpg-auto-import-keys --root $cache/partial-$arch --non-interactive refresh

    arch_pkgs=""
    if test "$arch" == "s390x"; then
        arch_pkgs="kernel-default-man"
    fi

    zypper --quiet --root $cache/partial-$arch --non-interactive --gpg-auto-import-keys in --auto-agree-with-licenses --no-recommends \
        acl attr audit-libs autoyast2 autoyast2-installation bzip2 checkmedia cpio cpp \
        cracklib cups-libs curl cyrus-sasl cyrus-sasl-digestmd5 cyrus-sasl-gssapi \
        cyrus-sasl-plain cyrus-sasl-saslauthd db-utils dbus-1 diffutils e2fsprogs \
        ed ethtool expect file fillup findutils grep groff gzip hwinfo \
        iproute2 iptables klogd krb5 less libacl libattr libcap2 libcom_err2 \
        libnscd libxcrypt libzypp limal limal-ca-mgm limal-ca-mgm-perl limal-perl \
        logrotate lvm2 m4 mailx make mdadm mingetty multipath-tools mutt ncurses-utils \
        net-tools netcfg openssh openssl parted perl perl-base permissions psmisc \
        reiserfs sed sysfsutils tar tcpd util-linux vim w3m wget yast2 yast2-bootloader \
        yast2-core yast2-country yast2-firewall yast2-hardware-detection yast2-installation \
        yast2-ldap yast2-ldap-client yast2-metapackage-handler yast2-mouse yast2-ncurses \
        yast2-ncurses-pkg yast2-network yast2-nfs-client yast2-ntp-client \
        yast2-online-update yast2-online-update-frontend yast2-packager yast2-pam \
        yast2-perl-bindings yast2-pkg-bindings yast2-printer yast2-registration \
        yast2-runlevel yast2-samba-client yast2-samba-server yast2-schema yast2-security \
        yast2-storage yast2-storage-lib yast2-support yast2-sysconfig \
        yast2_theme yast2-trans-stats yast2-transfer yast2-tune yast2-update yast2-users \
        yast2-xml zlib lxc supportutils iputils dhcpcd
    if [ $? -ne 0 ]; then
	echo "Failed to download the rootfs, aborting."
	return 1
    fi

    # Add sles packages if possible
    zypper --quiet --gpg-auto-import-keys --root $cache/partial-$arch --non-interactive se openslp-server >/dev/null 2>&1
    if test "$?" == "0"; then
        zypper --quiet --root $cache/partial-$arch --non-interactive --gpg-auto-import-keys in --auto-agree-with-licenses --no-recommends \
            fastjar yast2-ca-management yast2-dns-server yast2-instserver yast2-ldap-server yast2-nfs-server yast2-tftp-server
    fi

    mv "$1/partial-$arch" "$1/rootfs-$arch"
    echo "Download complete."

    return 0
}

copy_sles()
{
    cache=$1
    arch=$2
    rootfs=$3

    # make a local copy of the mini sles 
    echo -n "Copying rootfs to $rootfs ..."
    mkdir -p $rootfs
    rsync -a $cache/rootfs-$arch/ $rootfs/ || return 1
    return 0
}

install_sles()
{
    cache="/var/cache/lxc/sles"
    rootfs=$1
    mkdir -p /var/lock/subsys/
    (
	flock -x 200
	if [ $? -ne 0 ]; then
	    echo "Cache repository is busy."
	    return 1
	fi

	arch=$(arch)

	echo "Checking cache download in $cache/rootfs-$arch ... "
	if [ ! -e "$cache/rootfs-$arch" ]; then
	    download_sles $cache $arch
	    if [ $? -ne 0 ]; then
		echo "Failed to download 'sles base'"
		return 1
	    fi
	fi

	echo "Copy $cache/rootfs-$arch to $rootfs ... "
	copy_sles $cache $arch $rootfs
	if [ $? -ne 0 ]; then
	    echo "Failed to copy rootfs"
	    return 1
	fi

	return 0

	) 200>/var/lock/subsys/lxc

    return $?
}

copy_configuration()
{
    config_path=$1
    rootfs=$2
    name=$3

# only disable network if no network configuration was passed
sed '/^#/d' $config_path/$name/config | grep -q lxc.network.type
network_not_configured=$?
if [ $network_not_configured -eq 1 ]; then
   cat <<EOF >> $config_path/$name/config
lxc.network.type = empty
EOF
else
   type=$(sed '/^#/d; /lxc.network.type/!d; s/.*=[ \t]*//' $config_path/$name/config)
   sed '/^#/d' $config_path/$name/config | grep -q lxc.network.*.gateway
   gateway_not_configured=$?
   sed '/^#/d' $config_path/$name/config | grep -q lxc.network.ipv4
   ipv4_not_configured=$?
   if [ $gateway_not_configured ]; then
     [ $ipv4_not_configured -eq 0 ] && ipv4=$(sed '/^#/d; /lxc.network.ipv4/!d; /gateway/d; s/.*=[ \t]*//; s/\([[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\).*/\1/' $config_path/$name/config)
     if [ "$type" = "veth" -o "$type" = "macvlan" ]; then
      if [ $ipv4_not_configured -eq 0 -a "$ipv4" != "0.0.0.0" ]; then
       # set default route
       IP=$(/sbin/ip route | awk '/default/ { print $3 }')
       echo "lxc.network.ipv4.gateway = $IP " >> $config_path/$name/config
      else
	   # set network as dhcp
	   sed -i -e 's/BOOTPROTO=.*/BOOTPROTO=dhcp/' $rootfs/etc/sysconfig/network/ifcfg-eth0
      fi
     fi
   fi
   if [ "$type" != "empty" ]; then
       echo "#remove next line if host DNS configuration should not be available to container" >> $config_path/$name/config
       echo "lxc.mount.entry = /etc/resolv.conf etc/resolv.conf none bind,ro 0 0" >> $config_path/$name/config
   fi
fi

    cat <<EOF >> $config_path/$name/config
lxc.utsname = $name

lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $rootfs
lxc.mount = $config_path/$name/fstab

# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined

lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm
# consoles
lxc.cgroup.devices.allow = c 5:1 rwm
lxc.cgroup.devices.allow = c 5:0 rwm
lxc.cgroup.devices.allow = c 4:0 rwm
lxc.cgroup.devices.allow = c 4:1 rwm
# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm
# rtc
lxc.cgroup.devices.allow = c 254:0 rwm
EOF

    cat <<EOF > $config_path/$name/fstab
proc            proc         proc	nodev,noexec,nosuid 0 0
sysfs           sys          sysfs	defaults  0 0
EOF

    if [ $? -ne 0 ]; then
	echo "Failed to add configuration"
	return 1
    fi

    return 0
}

clean()
{
    cache="/var/cache/lxc/sles"

    if [ ! -e $cache ]; then
	exit 0
    fi

    # lock, so we won't purge while someone is creating a repository
    (
	flock -x 200
	if [ $? != 0 ]; then
	    echo "Cache repository is busy."
	    exit 1
	fi

	echo -n "Purging the download cache..."
	rm --preserve-root --one-file-system -rf $cache && echo "Done." || exit 1
	exit 0

    ) 200>/var/lock/subsys/lxc
}

usage()
{
    cat <<EOF
$1 -h|--help -p|--path=<path> --clean
EOF
    return 0
}

options=$(getopt -o hp:n:c -l help,path:,name:,clean -- "$@")
if [ $? -ne 0 ]; then
    usage $(basename $0)
    exit 1
fi
eval set -- "$options"

while true
do
    case "$1" in
	-h|--help)      usage $0 && exit 0;;
	-p|--path)      path=$2; shift 2;;
	-n|--name)      name=$2; shift 2;;
	-c|--clean)     clean=$2; shift 2;;
	--)             shift 1; break ;;
        *)              break ;;
    esac
done

if [ ! -z "$clean" -a -z "$path" ]; then
    clean || exit 1
    exit 0
fi

type zypper > /dev/null
if [ $? -ne 0 ]; then
    echo "'zypper' command is missing"
    exit 1
fi

if [ -z "$path" ]; then
    echo "'path' parameter is required"
    exit 1
fi

if [ "$(id -u)" != "0" ]; then
    echo "This script should be run as 'root'"
    exit 1
fi

rootfs=$path/rootfs
config_path=/etc/lxc

install_sles $rootfs
if [ $? -ne 0 ]; then
    echo "failed to install sles"
    exit 1
fi

configure_sles $rootfs $name
if [ $? -ne 0 ]; then
    echo "failed to configure sles for a container"
    exit 1
fi

copy_configuration $config_path $rootfs $name
if [ $? -ne 0 ]; then
    echo "failed write configuration file"
    exit 1
fi

if [ ! -z $clean ]; then
    clean || exit 1
    exit 0
fi