監視サーバー(munin)をリプレースするついでにredmineを一撃インストール。さくらのVPS 2G(HDD)にCentOS6をISOイメージからインストール後、本エントリー末尾に添付した一撃シェルスクリプトをrootで実行。30分くらいして再起動したらもう使えるようにはなっています。以前こんなの作りましたが、格段に進化しています。
WEBサーバーはnginx+unicornで動くようにしています。あと、すぐW○rdPressなんかをインストールできるように、PHPもさらっとインストールしています。気に入らなければコメントアウトするなりしていただければ。。。
動作の前提条件ですが、OS初期インストール時のホスト名は localhost.localdomain にしておいてください。MySQLのrootパスワード変更のところでコケますので。 mysql -N -s -e “select host,user from mysql.user;” からawkでゴニョゴニョしてもよかったのですが面d(略
実行ログは勝手に /root/logs 以下に取られるようにしていますので、scriptコマンド打たなくてもデバッグはできます。あれ、yumとかのプログレスバーでログ汚くなっちゃいますもんね (´・_・`)
所々、意図は汲んでもらえるかと思いますが、CentOS 6と7でOSのバージョンを見て条件分岐してserviceコマンド叩くかsystemctlコマンド叩くかの処理をわけてますが、あまり徹底していませんごめんなさい。
Redmine実践ガイド 理論と実践、事例で学ぶ新しいプロジェクトマネジメント
#!/bin/bash set -uex LANG=C # rootユーザー以外が実行しようとすると異常終了させる [ ! ${USER} = root ] && exit 1 # UNIXアカウント(一般ユーザー)を変数に格納する CREATEUSER=oresama # ベーシック認証のユーザーとパスワードを変数に格納する AUTHUSER=username AUTHPASS=B@S1cAuThP@sSw0rD # Redmine用DB、ユーザーを変数に格納する DBNAME=redminedb DBUSER=redmine DBUSERPW=rEdM1n3P@sSw0Rd # Redmineインストール対象ブランチを決める # 2 = Version2 # 3 = Version3 REDMINEVERSION=3 # Redmineのドキュメントルートを変数に格納する MINEDIR=/var/www/html/redmine # MySQL rootユーザーのパスワードを生成する MYSQLROOTPW=$(cat /dev/urandom | tr -dc '[:alnum:]' | head -c 16) # OSのバージョンを変数に格納する OSVER=$(rpm -qi centos-release | grep ^Version | awk '{print $3}') # 以降の処理をすべてログに残す LOGDIR=${HOME}/logs LOGFILE=${LOGDIR}/$(uname -n)_$(date +%Y%m%d%H%M%S)_$(basename ${0})_${$}.LOG mkdir -p ${LOGDIR} exec >> ${LOGFILE} exec 2>&1 # date # コンソールログイン用のパスワードを生成する TMPPW=$(cat /dev/urandom | tr -dc '[:alnum:]' | head -c 16) # ホスト名を付け替える ## 変数設定 DOMAIN=example.com NODENAME=mine ## ホスト名付け替え export NEWHOSTNAME=${NODENAME}.${DOMAIN} ## ホスト名の恒久的な付け替え hostname ${NEWHOSTNAME} sed -i.orig "/^HOSTNAME/s/\=[[:alnum:].]*/=${NEWHOSTNAME}/" /etc/sysconfig/network # Firewall (IPTABLES) 設定 service iptables stop iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP iptables -A INPUT -i lo -j ACCEPT iptables -I INPUT -p icmp --icmp-type 0 -j ACCEPT iptables -I INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 10022 -j ACCEPT # iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --dport 22 -j ACCEPT iptables -A INPUT -s 192.16.0.0/24 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -s 172.16.0.0/16 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT service iptables save service iptables start chkconfig iptables on # SELinux 無効化 setenforce 0 sed -i.orig 's/enforcing$/disabled/' /etc/selinux/config # sshd 設定 SSHDCONFIG=/etc/ssh/sshd_config cp -p ${SSHDCONFIG} ${SSHDCONFIG}.orig sed -i "/^#Port[[:space:]]22$/a\Port 22" ${SSHDCONFIG} sed -i "/^Port[[:space:]]22$/a\Port 10022" ${SSHDCONFIG} sed -i "/^#GSSAPIAuthentication no/s/#//" ${SSHDCONFIG} sed -i "/^GSSAPIAuthentication yes/s/yes$/no/" ${SSHDCONFIG} sed -i "/^GSSAPICleanupCredentials yes/s/yes$/no/" ${SSHDCONFIG} sed -i "s/#GSSAPIStrictAcceptorCheck yes/GSSAPIStrictAcceptorCheck no/" ${SSHDCONFIG} sed -i "/#GSSAPIKeyExchange no/s/#//" ${SSHDCONFIG} sed -i "s/#UseDNS yes/UseDNS no/" ${SSHDCONFIG} cp -p ${SSHDCONFIG} ${SSHDCONFIG}.TMP awk 'NR==1||prev!=$0;{prev=$0}' ${SSHDCONFIG}.TMP > ${SSHDCONFIG} rm -f ${SSHDCONFIG}.TMP service sshd reload # Group ADD groupadd -g 500 hamada groupadd -g 501 webmaster # User ADD useradd -u 500 -g 500 ${CREATEUSER} echo ${CREATEUSER}:${TMPPW} | tee PASSWD chpasswd < PASSWD mkdir -p /home/${CREATEUSER}/.ssh/ chmod 700 /home/${CREATEUSER}/.ssh/ touch /home/${CREATEUSER}/.ssh/authorized_keys chmod 600 /home/${CREATEUSER}/.ssh/authorized_keys cat << _EOL_ | tee /home/${CREATEUSER}/.ssh/authorized_keys ssh-rsa XXXXXXXX _EOL_ chown -R ${CREATEUSER}. /home/${CREATEUSER}/.ssh/ # PasswordFile Remove rm -f PASSWD # sudoers User Add cat << _EOL_ | tee /etc/sudoers.d/${CREATEUSER} ${CREATEUSER} ALL=(ALL) NOPASSWD: ALL _EOL_ # OpenSSH clients install yum -y install openssh-clients rsync # NTP install yum -y install ntp ntpdate NTPCONF=/etc/ntp.conf [ ! -f ${NTPCONF}.orig ] && cp -p ${NTPCONF}{,.orig} || cp -p ${NTPCONF}{,.$(date +%Y%m%d)00} sed -i "s/restrict default kod nomodify notrap nopeer noquery/restrict default ignore/" ${NTPCONF} sed -i "s/restrict -6 default kod nomodify notrap nopeer noquery/restrict -6 default ignore/" ${NTPCONF} sed -i "/restrict -6 default ignore/a\restrict -6 ntp1.sakura.ad.jp kod nomodify notrap nopeer noquery" ${NTPCONF} sed -i "/restrict -6 default ignore/a\restrict ntp1.sakura.ad.jp kod nomodify notrap nopeer noquery" ${NTPCONF} sed -i "s/server 0.centos.pool.ntp.org/server ntp1.sakura.ad.jp iburst/" ${NTPCONF} sed -i "/server [12].centos.pool.ntp.org/d" ${NTPCONF} chkconfig ntpd on chkconfig ntpdate on # Yum Update yum -y update # epel Repository install if [ ! -f /etc/yum.repos.d/epel.repo ]; then yum -y install epel-release mkdir -p /etc/yum.repos.d/BACKUP/ sed -i.orig "s/enabled=1/enabled=0/" /etc/yum.repos.d/epel.repo mv /etc/yum.repos.d/epel.repo.orig /etc/yum.repos.d/BACKUP/ fi # remi Repository install REMIRPM=http://rpms.famillecollet.com/enterprise/remi-release-6.rpm if [ 0 = $(yum list installed | grep epel-release > /dev/null 2>&1) ]; then yum -y install ${REMIRPM} else yum -y install epel-release mkdir -p /etc/yum.repos.d/BACKUP/ sed -i.$(date +%Y%m%d)00 "s/enabled=1/enabled=0/" /etc/yum.repos.d/epel.repo mv /etc/yum.repos.d/epel.repo.$(date +%Y%m%d)00 /etc/yum.repos.d/BACKUP/ yum -y install ${REMIRPM} fi # perl modules install yum -y install \ perl \ perl-CGI \ perl-Cache-Memcached \ perl-Class-Singleton \ perl-Compress-Raw-Zlib \ perl-Compress-Zlib \ perl-DBD-Pg \ perl-DBI \ perl-Date-Manip \ perl-DateTime \ perl-Digest-HMAC \ perl-Digest-SHA1 \ perl-Email-Date-Format \ perl-File-Copy-Recursive \ perl-IO-Compress-Base \ perl-IO-Compress-Zlib \ perl-IO-Socket-INET6 \ perl-List-MoreUtils \ perl-MIME-Lite \ perl-MIME-Types \ perl-MailTools \ perl-Module-Pluggable \ perl-Net-DNS \ perl-Net-SSLeay \ perl-Params-Validate \ perl-Pod-Escapes \ perl-Pod-Simple \ perl-Socket6 \ perl-String-CRC32 \ perl-Taint-Runtime \ perl-Time-HiRes \ perl-TimeDate \ perl-XML-DOM \ perl-XML-LibXML \ perl-XML-NamespaceSupport \ perl-XML-RegExp \ perl-XML-SAX \ perl-YAML-Syck \ perl-libs \ perl-version yum --enablerepo=epel -y install \ perl-Cache-Cache \ perl-Carp-Always \ perl-Crypt-DES \ perl-FCGI \ perl-HTML-Template \ perl-IO-Multiplex \ perl-IPC-ShareLite \ perl-Log-Dispatch \ perl-Log-Dispatch-FileRotate \ perl-Log-Log4perl \ perl-Mail-Sender \ perl-Mail-Sendmail \ perl-Net-CIDR \ perl-Net-SNMP \ perl-Net-Server # iptables穴開け (TCP80) if [ 6 = ${OSVER} ]; then iptables -A INPUT -p tcp --dport 80 -j ACCEPT service iptables save fi if [ 7 = ${OSVER} ]; then if [ 3 = $(systemctl status firewalld.service > /dev/null ; echo $?) ]; then systemctl start firewalld.service fi systemctl enable firewalld.service firewall-cmd --zone=public --add-service http firewall-cmd --zone=public --add-service http --permanent fi # nginxリポジトリインストール NGINXREPO=http://nginx.org/packages/centos/${OSVER}/noarch/RPMS/nginx-release-centos-${OSVER}-0.el${OSVER}.ngx.noarch.rpm yum -y install ${NGINXREPO} sed -i.orig 's/centos/mainline\/centos/' /etc/yum.repos.d/nginx.repo # nginxインストール yum -y install nginx # basic認証ファイル作成 PASSWORDFILE=/etc/nginx/htpasswd echo "${AUTHUSER}:$(openssl passwd -apr1 ${AUTHPASS})" > ${PASSWORDFILE} # nginx settings sed -i.orig "s/worker_processes[[:space:]]\+[0-9]\+/worker_processes auto/" /etc/nginx/nginx.conf cat << _EOL_ | tee /etc/nginx/conf.d/vhost.conf server { listen 80; server_name $(hostname); location / { root /var/www/html; index index.html index.htm; } location ^~ /munin-cgi/munin-cgi-graph/ { access_log off; fastcgi_split_path_info ^(/munin-cgi/munin-cgi-graph)(.*); fastcgi_param PATH_INFO \$fastcgi_path_info; fastcgi_pass unix:/var/run/munin/munin-cgi-graph.sock; include fastcgi_params; } location /munin/static/ { alias /etc/munin/static/; } location /munin/ { auth_basic "admin only"; auth_basic_user_file ${PASSWORDFILE}; fastcgi_split_path_info ^(/munin)(.*); fastcgi_param PATH_INFO \$fastcgi_path_info; fastcgi_pass unix:/var/run/munin/munin-cgi-html.sock; include fastcgi_params; } location /redmine { proxy_redirect off; proxy_set_header X-Real-IP \$remote_addr; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header Host \$http_host; proxy_connect_timeout 60; proxy_read_timeout 60; proxy_send_timeout 600; proxy_pass http://127.0.0.1:5001; } } _EOL_ # nginx start PROGNAME=nginx if [ 6 = ${OSVER} ]; then service ${PROGNAME} start ; chkconfig ${PROGNAME} on fi if [ 7 = ${OSVER} ]; then systemctl start ${PROGNAME} ; systemctl enable ${PROGNAME} fi # PHPインストール yum --enablerepo=remi -y install gd-last yum --enablerepo=remi-php56 -y install \ php-cli \ php-common \ php-fpm \ php-mbstring \ php-mysqlnd \ php-opcache \ php-pdo \ php-pear \ php-pecl-apcu \ php-pecl-jsonc \ php-pecl-zip \ php-xml \ php-xmlrpc \ php-gd # php.ini settings sed -i.orig "s/;date.timezone =/date.timezone = Asia\/Tokyo/" /etc/php.ini # php-fpm settings cp -p /etc/php-fpm.d/www.conf{,.orig} sed -i 's/^user = apache/;user = apache\nuser = nginx/' /etc/php-fpm.d/www.conf sed -i 's/^group = apache/;group = apache\ngroup = nginx/' /etc/php-fpm.d/www.conf chgrp nginx /var/lib/php/{session,wsdlcache} # php-fpm start PROGNAME=php-fpm if [ 6 = ${OSVER} ]; then service ${PROGNAME} start ; chkconfig ${PROGNAME} on fi if [ 7 = ${OSVER} ]; then systemctl start ${PROGNAME} ; systemctl enable ${PROGNAME} fi # munin install yum --enablerepo=epel -y install munin munin-node munin-nginx munin-common # munin.conf edit MUNINCONF=/etc/munin/munin.conf cp -p ${MUNINCONF}{,.orig} sed -i "s/^#dbdir/dbdir/" ${MUNINCONF} sed -i "s/^#htmldir/htmldir/" ${MUNINCONF} sed -i "s/^#logdir/logdir/" ${MUNINCONF} sed -i "s/^#rundir/rundir/" ${MUNINCONF} sed -i "/^graph_strategy/s/cron/cgi/" ${MUNINCONF} sed -i "/^html_strategy/s/cron/cgi/" ${MUNINCONF} # nginx munin config move mkdir -p /etc/nginx/conf.d/BACKUP/ cd /etc/nginx/conf.d for A in $(ls | egrep -v '(BACKUP|vhost)') do mv $A BACKUP/ done cd # munin-fcgi-graph edit mkdir -p /etc/init.d/BACKUP/ cp -p /etc/init.d/munin-fcgi-graph /etc/init.d/BACKUP/ sed -i "s/fcgi-graph.sock/munin-cgi-graph.sock/g" /etc/init.d/munin-fcgi-graph # munin-fcgi-html edit mkdir -p /etc/init.d/BACKUP/ cp -p /etc/init.d/munin-fcgi-html /etc/init.d/BACKUP/ sed -i "s/fcgi-html.sock/munin-cgi-html.sock/g" /etc/init.d/munin-fcgi-html # munin services start MUNINPROGS=() MUNINPROGS=("munin-fcgi-graph" "munin-fcgi-html" "munin-node") for PROGNAME in ${MUNINPROGS[@]} do if [ 6 = ${OSVER} ]; then chkconfig --add ${PROGNAME} ; chkconfig ${PROGNAME} on ; service ${PROGNAME} start fi if [ 7 = ${OSVER} ]; then systemctl start ${PROGNAME} ; systemctl enable ${PROGNAME} fi done # Redmine Install ## 開発ツールインストール yum -y install gcc libxml2 libxslt libxml2-devel libxslt-devel ## ruby 2.2.2のrpmパッケージをダウンロードする curl -LO https://github.com/feedforce/ruby-rpm/releases/download/2.2.2/ruby-2.2.2-1.el6.x86_64.rpm yum -y localinstall ruby-2.2.2-1.el6.x86_64.rpm ## yum.conf でrubyをexcludeする cp -p /etc/yum.conf{,.orig} cat /etc/yum.conf.orig | grep -v "#" | grep . > /etc/yum.conf echo "exclude=ruby*" >> /etc/yum.conf cat /etc/yum.conf.orig | egrep -v '^([[:alnum:]\[])' >> /etc/yum.conf ## ImageMagick , Header files and Japanese Font install yum -y install ImageMagick ImageMagick-devel ipa-pgothic-fonts ## MySQL Server install yum -y install http://dev.mysql.com/get/mysql-community-release-el${OSVER}-5.noarch.rpm yum -y install mysql-community-server mysql-community-devel ## MySQL起動 PROGNAME=mysqld if [ 6 = ${OSVER} ]; then service ${PROGNAME} start ; chkconfig --add ${PROGNAME} ; chkconfig ${PROGNAME} on fi if [ 7 = ${OSVER} ]; then systemctl start ${PROGNAME} ; systemctl enable ${PROGNAME} fi ## MySQL rootユーザーのパスワード設定 mysql -u root -e "SET PASSWORD FOR root@localhost=PASSWORD('${MYSQLROOTPW}');" echo [client] | tee ${HOME}/.my.cnf echo user=root | tee -a ${HOME}/.my.cnf echo password=\"${MYSQLROOTPW}\" | tee -a ${HOME}/.my.cnf #mysql -e "SET PASSWORD FOR root@\"${HOSTNAME}\"=PASSWORD('${MYSQLROOTPW}');" mysql -e "SET PASSWORD FOR root@\"${NEWHOSTNAME}\"=PASSWORD('${MYSQLROOTPW}');" mysql -e "SET PASSWORD FOR root@127.0.0.1=PASSWORD('${MYSQLROOTPW}');" mysql -e "SET PASSWORD FOR root@\"::1\"=PASSWORD('${MYSQLROOTPW}');" mysql -e "delete from mysql.user where user='';" mysql -e 'FLUSH PRIVILEGES;' ## Redmine用DB作成 mysql -u root -e "create database ${DBNAME} character set utf8;" ## Redmine用ユーザー作成 mysql -u root -e "GRANT ALL PRIVILEGES on ${DBNAME}.* to ${DBUSER}@localhost identified by \"${DBUSERPW}\";" mysql -e 'FLUSH PRIVILEGES;' ## bundler install gem install bundler --no-rdoc --no-ri ## Redmine Install mkdir -p ${HOME}/src/redmine cd ${HOME}/src/redmine LINKURI=http://www.redmine.org/projects/redmine/wiki/Download curl -O $(curl -s ${LINKURI} | \ grep -i href | \ grep tar.gz | \ grep "redmine-${REDMINEVERSION}" | \ sed -e "s/<li>//g;s/<a href=//g;s/<\/[[:alnum:]]*>//g;s/<code>//g;s/\"//g;s/>[[:alnum:]-]*[0-9.]*.tar.gz//g;s/[()]//g" | \ awk '{print "http://www.redmine.org"$1}') ## md5sum値チェック MD5SUM=$(curl -s http://www.redmine.org/projects/redmine/wiki/Download | grep -i href | grep tar.gz | grep "redmine-${REDMINEVERSION}" | sed -e "s/<li>//g;s/<a href=//g;s/<\/[[:alnum:]]*>//g;s/<code>//g;s/\"//g;s/>[[:alnum:]-]*[0-9.]*.tar.gz//g;s/[()]//g" | awk '{print $NF}') [ ! ${MD5SUM} = $(md5sum redmine-3.0.3.tar.gz | awk '{print $1}') ] && exit 1 ## Redmine解凍 REDMINE=$(ls | grep redmine-${REDMINEVERSION} | sed -e "s/.tar.gz//") tar xzf ${REDMINE}.tar.gz mv ${REDMINE} ${MINEDIR} # Redmine Settings cd ${MINEDIR}/config for A in production: adapter: database: host: username: password: encoding: do cat database.yml.example | \ egrep -m 1 $A done | \ sed -e "/database:/s/redmine/${DBNAME}/" | \ sed -e "/username:/s/root/${DBUSER}/" | \ sed -e "/password:/s/\"\"/${DBUSERPW}/" > database.yml cat << _EOL_ | tee /var/www/html/redmine/config/configuration.yml production: email_delivery: delivery_method: :smtp smtp_settings: address: ${NODENAME} port: 25 domain: ${DOMAIN} rmagick_font_path: /usr/share/fonts/ipa-pgothic/ipagp.ttf _EOL_ cd ${MINEDIR}/ gem install json -v '1.8.3' gem install nokogiri -v '1.6.6.2' -- --use-system-libraries gem install mysql2 -v '0.3.18' bundle install --without development test bundle exec rake generate_secret_token RAILS_ENV=production bundle exec rake db:migrate echo "gem 'unicorn'" > Gemfile.local bundle install cp -p config.ru config.ru.orig cat << _EOL_ | tee config.ru require ::File.expand_path('../config/environment', __FILE__) if ENV['RAILS_RELATIVE_URL_ROOT'] map ENV['RAILS_RELATIVE_URL_ROOT'] do run RedmineApp::Application end else run RedmineApp::Application end _EOL_ echo "working_directory '${MINEDIR}'" > config/unicorn.rb chown -R nginx:hamada ${MINEDIR}/ chmod -R g+w ${MINEDIR}/ touch /etc/init.d/redmine chmod 700 /etc/init.d/redmine cat << '_EOL_' | tee /etc/init.d/redmine #!/bin/bash # REDMINE ### BEGIN INIT INFO # Provides: redmine # Required-Start: $local_fs $remote_fs $network $syslog redis-server # Required-Stop: $local_fs $remote_fs $network $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Redmine # Description: Redmine # chkconfig: - 75 25 ### END INIT INFO export PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin APP_NAME=redmine APP_ROOT=_MINEDIR_ APP_PATH="/redmine" CONFIGS="$APP_ROOT/config/unicorn.rb" PID="$APP_ROOT/tmp/pids/unicorn.pid" ENV=production PORT=5001 UNICORN_OPTS="-D -E $ENV -c $CONFIGS --path $APP_PATH -p $PORT" start() { if [ -e $PID ]; then echo "$APP_NAME already started"; exit 1; fi echo "start $APP_NAME"; cd $APP_ROOT bundle exec unicorn_rails $UNICORN_OPTS } stop() { if [ ! -e $PID ]; then echo "$APP_NAME not started"; exit 1; fi echo "stop $APP_NAME"; kill -QUIT `cat ${PID}` rm -f $PID } force_stop() { if [ ! -e $PID ]; then echo "$APP_NAME not started"; exit 1; fi echo "stop $APP_NAME"; kill -TERM `cat ${PID}` rm -f $PID } reload() { if [ ! -e $PID ]; then echo "$APP_NAME not started"; start exit 0; fi echo "reload $APP_NAME"; kill -HUP `cat ${PID}` } restart() { stop start } case "$1" in start) start ;; stop) stop ;; force-stop) force_stop ;; reload) reload ;; restart) restart ;; *) echo "Usage: $(basename $0) [start|stop|force-stop|reload|restart]" ;; esac exit _EOL_ sed -i "s/_MINEDIR_/$(echo ${MINEDIR} | sed -e 's/\//\\\//g')/g" /etc/init.d/redmine chkconfig --add redmine # date # reboot