setup

#!/usr/bin/env bash

freebsd_rc_conf_enable_yes() {
	local what="$1"
	
	if [ -z "$what" ]; then
		echo "usage: freebsd_rc_conf_enable <what>"
		exit 1
	fi
	
	echo freebsd rc $what
	if ! grep -q '^'"$what"'_enable="YES"' /etc/rc.conf; then
		if grep -q '^'"$what"'_enable=' /etc/rc.conf; then
			sudo -nA sed -i '' -e 's%^'"$what"'_enable=.*%'"$what"'_enable="YES"%' /etc/rc.conf ||
			exit 1
		else
			echo "$what"'_enable="YES"' | sudo -nA tee -a /etc/rc.conf >/dev/null ||
			exit 1
		fi
		REBOOT=1
	fi
}

mysed() {
	case "$DISTRIBUTION" in
		freebsd*)
			sudo -nA sed -i '' -e "$@"
			;;

		sunos)
			sudo -nA gsed -i -e "$@"
			;;

		*)
			sudo -nA sed -i "$@"
			;;
	esac
}

DISTRIBUTION=`cat dist 2>/dev/null`

if [ -z "$DISTRIBUTION" ]; then
	echo "No distribution?"
	exit 1
fi

REBOOT=0
NTP_CONF=/etc/ntp.conf
SSHD_CONF=/etc/ssh/sshd_config
			
case "$DISTRIBUTION" in
	ubuntu)
		export LC_ALL="en_US.UTF-8"
		export LANGUAGE="en_US.UTF-8"
		LIBBOTAN="libbotan1.8-dev"
		if lsb_release -r 2>/dev/null | grep -q "14.04" 2>/dev/null; then
			LIBBOTAN="libbotan1.10-dev"
		fi
		rm -f apt.log
		echo apt-get update &&
		sudo -nA apt-get -y update &&
		echo apt-get dist-upgrade &&
		sudo -nA apt-get -y dist-upgrade >>apt.log &&
		echo apt-get install &&
		sudo -nA apt-get -y install build-essential \
			open-vm-tools \
			default-jre \
			libxml2-dev \
			libsqlite3-dev \
			sqlite3 \
			"$LIBBOTAN" \
			libssl-dev \
			autoconf \
			automake \
			libtool \
			ccache \
			libcunit1-dev \
			doxygen \
			graphviz \
			gdb \
			valgrind \
			ntp \
			protobuf-compiler \
			libprotobuf-dev \
			libcppunit-dev \
			mysql-server \
			libmysqlclient-dev \
			git-svn \
			subversion \
			libjudy-dev \
			bind9 \
			libnet-dns-perl libnet-dns-sec-perl >>apt.log ||
		{ cat apt.log; exit 1; }
		cat apt.log
		packages=`grep '[0-9]* upgraded, [0-9]* newly installed, [0-9]* to remove and [0-9]* not upgraded.' apt.log | awk '{ a=a+$1+$3 } END { print a }'`
		if [ -n "$packages" -a "$packages" != "0" ]; then
			REBOOT=1
		fi
		if [ -f /var/run/reboot-required ]; then
			REBOOT=1
		fi

		echo ubuntu bind
		sudo -nA service bind9 stop
		sudo -nA update-rc.d bind9 disable &&
		if [ -f /etc/apparmor.d/usr.sbin.named ]; then
			sudo -nA ln -sf /etc/apparmor.d/usr.sbin.named /etc/apparmor.d/disable/ &&
			sudo -nA service apparmor reload
		fi ||
		exit 1

		;;
		
	redhat|centos)
		echo yum install epel
		rpm -q epel-release >/dev/null 2>/dev/null ||
		sudo -nA yum -y install http://mirrors.se.eu.kernel.org/fedora-epel/6/x86_64/epel-release-6-8.noarch.rpm ||
		exit 1

		rm -f yum.log
		echo yum remove fprintd &&
		sudo -nA yum -y remove fprintd &&
		echo yum update &&
		sudo -nA yum -y update >>yum.log &&
		echo yum groupinstall &&
		sudo -nA yum -y groupinstall "Development Tools" >>yum.log &&
		echo yum install &&
		sudo -nA yum -y install open-vm-tools \
			libxml2-devel \
			sqlite-devel \
			openssl-devel \
			botan-devel \
			ccache \
			CUnit-devel \
			graphviz \
			protobuf-devel \
			mysql-server \
			mysql-devel \
			ntp \
			wget \
			Judy-devel \
			bind \
			perl-Net-DNS perl-Net-DNS-SEC >>yum.log &&
		echo chkconfig ntp &&
		sudo -nA chkconfig ntpd on &&
		echo chkconfig mysql &&
		sudo -nA chkconfig mysqld on ||
		{ cat yum.log; exit 1; }
		cat yum.log
		packages=`grep '^\(Install\|Upgrade\) *[0-9]* Package' yum.log | awk '{ a=a+$2 } END { print a }'`
		if [ -n "$packages" -a "$packages" != "0" ]; then
			REBOOT=1
		fi
		;;
		
	suse)
		export PATH="$PATH:/sbin:/usr/sbin"
		rm -f zypper.log
		echo zypper update &&
		sudo -nA zypper --non-interactive-include-reboot-patches -n update -l >>zypper.log &&
		echo zypper install pattern &&
		sudo -nA zypper --non-interactive-include-reboot-patches -n install -l -t pattern Basis-Devel >>zypper.log &&
		echo zypper install &&
		sudo -nA zypper --non-interactive-include-reboot-patches -n install -l java-1_6_0-ibm \
			doxygen \
			graphviz \
			libcppunit-devel \
			valgrind \
			libxml2-devel \
			sqlite3-devel \
			ccache \
			subversion \
			git \
			mysql \
			libmysqlclient-devel \
			ntp \
			bind >>zypper.log &&
		echo chkconfig ntp &&
		sudo -nA chkconfig ntp on &&
		echo chkconfig mysql &&
		sudo -nA chkconfig mysql on ||
		{ cat zypper.log; exit 1; }
		cat zypper.log

		packages=`grep '^[0-9][0-9]*.*package.*\(upgrade\|install\|remove\|change arch\)' zypper.log | \
			while read line; do \
				for part in $line; do \
					if echo "$part" | grep -q '^[0-9][0-9]*$'; then \
						echo "$part"; \
					fi; \
				done; \
			done | awk '{ a=a+$1 } END { print a }'`
		if [ -n "$packages" -a "$packages" != "0" ]; then
			REBOOT=1
		fi

		echo suse cpan
		sudo rm -f /usr/lib/perl5/5.10.0/CPAN/Config.pm &&
		echo -e "yes\no conf prerequisites_policy follow\no conf commit\nquit\n" | sudo -nA cpan &&
		sudo -nA sed -i -e 's%^1;$%$CPAN::FTP::connect_to_internet_ok = 1;\n1;%' /usr/lib/perl5/5.10.0/CPAN/Config.pm &&
		sudo -nA cpan -i Net::DNS::SEC ||
		exit 1

		echo suse apparmor
		if [ -f /etc/apparmor.d/usr.sbin.named ]; then
			sudo -nA rm -f /etc/apparmor.d/usr.sbin.named ||
			exit 1
			REBOOT=1
		fi
		;;

	freebsd9)
		echo freebsd-update cron
		if [ ! -f /var/cron/tabs/root ]; then
			echo '0 3 * * * /usr/sbin/freebsd-update cron' | sudo -nA tee -a /var/cron/tabs/root >/dev/null &&
			sudo -nA chmod 600 /var/cron/tabs/root ||
			exit 1
		else
			if ! grep -q '^0 3 * * * /usr/sbin/freebsd-update cron' /var/cron/tabs/root; then
				echo '0 3 * * * /usr/sbin/freebsd-update cron' | sudo -nA tee -a /var/cron/tabs/root >/dev/null &&
				sudo -nA chmod 600 /var/cron/tabs/root ||
				exit 1
			fi
		fi

		rm -f update.log
		echo freebsd-update install
		if sudo -nA freebsd-update install >update.log; then
			REBOOT=1
		else
			if ! grep -q '^No updates are available to install.$' update.log; then
				cat update.log
				exit 1
			fi
		fi
		cat update.log
		
		rm -f upgrade.log
		export BRANCH="9-stable"
		echo bsdadminscripts &&
		sudo -nA pkg_add -Fr bsdadminscripts &&
		echo pkg_upgrade &&
		sudo -nA -E pkg_upgrade -avX >upgrade.log ||
		{
			rm -rf pub &&
			mkdir -p pub/FreeBSD/ports/amd64/packages-9-stable &&
			fetch -mo pub/FreeBSD/ports/amd64/packages-9-stable/INDEX-9.bz2 ftp://ftp.freebsd.org/pub/FreeBSD/ports/amd64/packages-9-stable/INDEX-9.bz2 &&
			bunzip2 pub/FreeBSD/ports/amd64/packages-9-stable/INDEX-9.bz2 &&
			mv pub/FreeBSD/ports/amd64/packages-9-stable/INDEX-9 pub/FreeBSD/ports/amd64/packages-9-stable/INDEX &&
			PACKAGEROOT=`pwd` sudo -nA -E pkg_upgrade -avX >>upgrade.log
		} ||
		{ cat upgrade.log; exit 1; }
		cat upgrade.log
		if grep -q '^Install [0-9]* package' upgrade.log; then
			REBOOT=1
		fi

		for pkg in open-vm-tools-nox11 \
			"openjdk6:openjdk6-[a-z0-9]*" \
			libxml2 \
			openssl \
			ccache \
			wget \
			sha \
			coreutils \
			cunit \
			doxygen \
			ntp \
			gdb \
			valgrind \
			protobuf \
			cppunit \
			mysql55-server:mysql-server- \
			mysql55-client:mysql-client- \
			git \
			Judy \
			gmake \
			autoconf \
			automake \
			libtool \
			apr \
			bind98 \
			p5-Net-DNS p5-Net-DNS-SEC;
		do
			chk="$pkg-"
			if echo "$pkg" | grep -q ':'; then
				chk=`echo "$pkg" | sed 's%:% %' | awk '{ print $2 }'`
				pkg=`echo "$pkg" | sed 's%:% %' | awk '{ print $1 }'`
			fi
			echo "Checking pkg $pkg (match $chk)"
			pkgs=`pkg_info | grep "^$chk[0-9]" | wc -l | awk '{ print $1 }'`
			if [ "$pkgs" = "1" ]; then
				echo "Skip $pkg, installed"
				continue
			fi
			
			rm -f install.log
			if ! sudo -nA -E pkg_add -Fr "$pkg" 2>install.log; then
				cat install.log
				exit 1
			fi
			cat install.log
			if ! grep -q '^pkg_add: package .* or its older version already installed' install.log; then
				REBOOT=1
			fi
		done
		
		freebsd_rc_conf_enable_yes mysql
		freebsd_rc_conf_enable_yes ntpd
		freebsd_rc_conf_enable_yes vmware_guest_vmblock
		freebsd_rc_conf_enable_yes vmware_guest_vmhgfs
		freebsd_rc_conf_enable_yes vmware_guest_vmmemctl
		freebsd_rc_conf_enable_yes vmware_guest_vmxnet
		freebsd_rc_conf_enable_yes vmware_guestd

		echo fstab fdescfs
		if ! grep -q '^fdesc /dev/fd fdescfs rw 0 0$' /etc/fstab; then
			echo 'fdesc /dev/fd fdescfs rw 0 0' | sudo -nA tee -a /etc/fstab >/dev/null ||
			exit 1
		fi
		echo fstab procfs
		if ! grep -q '^proc /proc procfs rw 0 0$' /etc/fstab; then
			echo 'proc /proc procfs rw 0 0' | sudo -nA tee -a /etc/fstab >/dev/null ||
			exit 1
		fi
		;;

	freebsd10)
		echo freebsd-update cron
		if [ ! -f /var/cron/tabs/root ]; then
			echo '0 3 * * * /usr/sbin/freebsd-update cron' | sudo -nA tee -a /var/cron/tabs/root >/dev/null &&
			sudo -nA chmod 600 /var/cron/tabs/root ||
			exit 1
		else
			if ! grep -q '^0 3 * * * /usr/sbin/freebsd-update cron' /var/cron/tabs/root; then
				echo '0 3 * * * /usr/sbin/freebsd-update cron' | sudo -nA tee -a /var/cron/tabs/root >/dev/null &&
				sudo -nA chmod 600 /var/cron/tabs/root ||
				exit 1
			fi
		fi

		rm -f update.log
		echo freebsd-update install
		if sudo -nA freebsd-update install >update.log; then
			REBOOT=1
		else
			if ! grep -q '^No updates are available to install.$' update.log; then
				cat update.log
				exit 1
			fi
		fi
		cat update.log
		
		rm -f upgrade.log
		echo pkg update &&
		sudo pkg update &&
		echo pkg upgrade &&
		sudo pkg upgrade -y >upgrade.log ||
		{ cat upgrade.log; exit 1; }
		cat upgrade.log
		if ! grep -q '^Nothing to do$' upgrade.log; then
			REBOOT=1
		fi

		for pkg in bind-tools;
		do
			sudo -nA pkg delete -y "$pkg"
		done

		for pkg in open-vm-tools-nox11 \
			"openjdk6:openjdk6-[a-z0-9]*" \
			libxml2 \
			sqlite3 \
			openssl \
			botan \
			ccache \
			wget \
			coreutils \
			cunit \
			doxygen \
			ntp \
			gdb \
			valgrind \
			protobuf \
			cppunit \
			mysql55-server \
			mysql55-client \
			git \
			subversion \
			Judy \
			gmake \
			autoconf \
			automake \
			libtool \
			bind99 \
			p5-Net-DNS p5-Net-DNS-SEC;
		do
			chk="$pkg-"
			if echo "$pkg" | grep -q ':'; then
				chk=`echo "$pkg" | sed 's%:% %' | awk '{ print $2 }'`
				pkg=`echo "$pkg" | sed 's%:% %' | awk '{ print $1 }'`
			fi
			echo "Checking pkg $pkg (match $chk)"
			pkgs=`pkg info | grep "^$chk[0-9]" | wc -l | awk '{ print $1 }'`
			if [ "$pkgs" = "1" ]; then
				echo "Skip $pkg, installed"
				continue
			fi
			
			rm -f install.log
			if ! sudo -nA pkg install -y "$pkg" 2>install.log; then
				cat install.log
				exit 1
			fi
			cat install.log
			if ! grep -q "^$pkg.* already installed$" install.log; then
				REBOOT=1
			fi
		done
		
		freebsd_rc_conf_enable_yes mysql
		freebsd_rc_conf_enable_yes ntpd
		freebsd_rc_conf_enable_yes vmware_guest_vmblock
		freebsd_rc_conf_enable_yes vmware_guest_vmhgfs
		freebsd_rc_conf_enable_yes vmware_guest_vmmemctl
		freebsd_rc_conf_enable_yes vmware_guest_vmxnet
		freebsd_rc_conf_enable_yes vmware_guestd

		echo fstab fdescfs
		if ! grep -q '^fdesc /dev/fd fdescfs rw 0 0$' /etc/fstab; then
			echo 'fdesc /dev/fd fdescfs rw 0 0' | sudo -nA tee -a /etc/fstab >/dev/null ||
			exit 1
		fi
		echo fstab procfs
		if ! grep -q '^proc /proc procfs rw 0 0$' /etc/fstab; then
			echo 'proc /proc procfs rw 0 0' | sudo -nA tee -a /etc/fstab >/dev/null ||
			exit 1
		fi
		;;
	
	sunos)
		echo pkg refresh
		sudo -nA pkg refresh ||
		exit 1
		
		rm -f update.log
		echo pkg update
		sudo -nA pkg update >update.log
		status="$?"
		cat update.log
		
		if [ "$status" = "0" ]; then
			REBOOT=1
		else
			if ! grep -q '^No updates available for this image.$' update.log; then
				exit 1
			fi
		fi
		
		rm -f install.log
		echo pkg install
		sudo -nA pkg install gcc-3 \
			gnu-make \
			libtool \
			autoconf \
			automake-110 \
			libxml2 \
			stdcxx \
			developer/base-developer-utilities \
			group/feature/developer-gnu \
			ucb \
			c++-runtime \
			doxygen \
			graphviz \
			mysql-51 \
			mysql-51/library >install.log
		status="$?"
		cat install.log
		
		if [ "$status" = "0" ]; then
			REBOOT=1
		else
			if ! grep -q '^No updates necessary for this image.$' install.log; then
				exit 1
			fi
		fi
		
		echo ntp.conf
		NTP_CONF=/etc/inet/ntp.conf
		if [ ! -f $NTP_CONF ]; then
			sudo -nA cp /etc/inet/ntp.client $NTP_CONF ||
			exit 1
		fi
		echo svcs ntp
		if ! svcs ntp | grep -q '^online'; then
			sudo -nA svcadm enable ntp ||
			exit 1
		fi

		echo sunos cpan
		sudo rm -f /usr/perl5/5.12/lib/CPAN/Config.pm &&
		echo -e "yes\nno\nno\nftp://ftp.sunet.se/pub/lang/perl/CPAN/\n\no conf prerequisites_policy follow\no conf make /usr/bin/gmake\no conf make_arg CC'=gcc LD=gcc CCCDLFLAGS=-fPIC OPTIMIZE=-O3'\no conf make_install_make_command /usr/bin/gmake\no conf commit\nquit\n" | sudo -nA /usr/perl5/5.12/bin/cpan &&
		sudo -nA gsed -i -e 's%^1;$%$CPAN::FTP::connect_to_internet_ok = 1;\n1;%' /usr/perl5/5.12/lib/CPAN/Config.pm &&
		sudo -nA /usr/perl5/5.12/bin/cpan -i Net::DNS::SEC ||
		exit 1
		;;

	*)
		echo "Unknown dist"
		exit 1
esac

#
# MySQL
#

echo mysql start
case "$DISTRIBUTION" in
	redhat|centos)
		if ! sudo -nA service mysqld status >/dev/null 2>/dev/null; then
			sudo -nA service mysqld start ||
			exit 1
		fi
		;;

	suse)
		if ! sudo -nA service mysql status >/dev/null 2>/dev/null; then
			sudo -nA service mysql start ||
			exit 1
		fi
		;;
	
	freebsd*)
		if ! sudo -nA /usr/local/etc/rc.d/mysql-server status >/dev/null 2>/dev/null; then
			sudo -nA /usr/local/etc/rc.d/mysql-server start ||
			exit 1
		fi
		;;

	sunos)
		if ! svcs mysql | grep -q '^online'; then
			sudo -nA svcadm enable mysql ||
			exit 1
			I=0
			while true; do
				mysql -u root -e 'SELECT 0' 2>/dev/null >/dev/null &&
				break
				if [ $I -gt 30 ]; then
					echo "unable to start mysql"
					exit 1
				fi
				I=$(( I + 1 ))
				sleep 2
			done
		fi
		;;
esac

echo mysql secure
mysql -u root -e 'DROP DATABASE test'
mysql -u root -e 'DROP DATABASE build'
mysql -u root -e 'DROP USER test'
mysql -u root -e 'DROP USER build'
mysql -u root -e 'DELETE FROM mysql.db WHERE Db="test" OR Db="test\\_%"'
mysql -u root -e 'DELETE FROM mysql.user WHERE User=""' &&
mysql -u root -e 'DELETE FROM mysql.user WHERE User="root" AND Host NOT IN ("localhost", "127.0.0.1", "::1")' &&
mysql -u root -e 'FLUSH PRIVILEGES' ||
exit 1
echo mysql db test
if ! mysql -u root -B -e 'show databases' | grep -q '^test$'; then
	mysqladmin -u root create test &&
	mysql -u root -e 'grant all on test.* to test@localhost identified by "test"' ||
	exit 1
fi
echo mysql db build
if ! mysql -u root -B -e 'show databases' | grep -q '^build$'; then
	mysqladmin -u root create build &&
	mysql -u root -e 'grant all on build.* to build@localhost identified by "build"' ||
	exit 1
fi

#
# ntpd
#

echo ntp
if ! sudo -nA grep -q '^tinker panic 0$' $NTP_CONF; then
	echo "tinker panic 0" | sudo -nA tee -a $NTP_CONF >/dev/null ||
	exit 1
	REBOOT=1
fi
if ! sudo -nA grep -q '^restrict 127.0.0.1$' $NTP_CONF; then
	echo "restrict 127.0.0.1" | sudo -nA tee -a $NTP_CONF >/dev/null ||
	exit 1
	REBOOT=1
fi
if ! sudo -nA grep -q '^restrict default' $NTP_CONF; then
	echo "restrict default kod nomodify notrap noquery" | sudo -nA tee -a $NTP_CONF >/dev/null ||
	exit 1
	REBOOT=1
else
	if ! sudo -nA grep -q '^restrict default kod nomodify notrap noquery$' $NTP_CONF; then
		mysed 's%^restrict default.*%restrict default kod nomodify notrap noquery%' $NTP_CONF ||
		exit 1
		REBOOT=1
	fi
fi
case "$DISTRIBUTION" in
	sunos)
		if ! grep -q '^server 0.nl.pool.ntp.org$' $NTP_CONF; then
			echo "server 0.nl.pool.ntp.org" | sudo -nA tee -a $NTP_CONF >/dev/null ||
			exit 1
			REBOOT=1
		fi
		if ! grep -q '^server 1.nl.pool.ntp.org$' $NTP_CONF; then
			echo "server 1.nl.pool.ntp.org" | sudo -nA tee -a $NTP_CONF >/dev/null ||
			exit 1
			REBOOT=1
		fi
		if ! grep -q '^server 2.nl.pool.ntp.org$' $NTP_CONF; then
			echo "server 2.nl.pool.ntp.org" | sudo -nA tee -a $NTP_CONF >/dev/null ||
			exit 1
			REBOOT=1
		fi
		if ! grep -q '^server 3.nl.pool.ntp.org$' $NTP_CONF; then
			echo "server 3.nl.pool.ntp.org" | sudo -nA tee -a $NTP_CONF >/dev/null ||
			exit 1
			REBOOT=1
		fi
		;;
esac

#
# jenkins user
#

echo user jenkins create
if ! grep -q '^jenkins:' /etc/passwd; then
	case "$DISTRIBUTION" in
		ubuntu|redhat|centos|suse|sunos)
			sudo -nA useradd -m jenkins ||
			exit 1
			;;

		freebsd*)
			echo 'jenkins::::::::/bin/sh:' | sudo -nA adduser -w no -f - ||
			exit 1
			;;

		*)
			exit 1
			;;
	esac
fi

echo user jenkins keys
case "$DISTRIBUTION" in
	ubuntu|redhat|centos|suse)
		sudo -nA su - -c 'mkdir -p .ssh && chmod 700 .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn13u8LWKtP+4e7nQ1RQOsxbGA/fls85h7YjACS/0EdrCFLP2q5BlbevEXAXTt65MdyawD1VLy7cskulkoTHxvBTzsZh44kYRSzR0FIxla4IHK9FcJJHrWqmLUegRett1Mnrr4VIruriNfwyM923vNEOdiDeRfDcpcYstMoQ+uEI6YI0qrC8BjbY0HysCGV+3N0AjE39vlLfpvWdMBtgf5PFlsgBvCD36k2kB+MDFo37qrJfEEtHhXJYh52BGXeoUdbivkBp2Z2q+a4b9xvKuqwPi/aCn2ILXKcPUDSPv4wUwEpVd+CupC0Nk1Bg2CGGOIqwVK7IVZpDmaHCIP4q2Z jenkins" > .ssh/authorized_keys && chmod 640 .ssh/authorized_keys' jenkins ||
		exit 1
		;;

	sunos)
		sudo -nA su - jenkins -c 'mkdir -p .ssh && chmod 700 .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn13u8LWKtP+4e7nQ1RQOsxbGA/fls85h7YjACS/0EdrCFLP2q5BlbevEXAXTt65MdyawD1VLy7cskulkoTHxvBTzsZh44kYRSzR0FIxla4IHK9FcJJHrWqmLUegRett1Mnrr4VIruriNfwyM923vNEOdiDeRfDcpcYstMoQ+uEI6YI0qrC8BjbY0HysCGV+3N0AjE39vlLfpvWdMBtgf5PFlsgBvCD36k2kB+MDFo37qrJfEEtHhXJYh52BGXeoUdbivkBp2Z2q+a4b9xvKuqwPi/aCn2ILXKcPUDSPv4wUwEpVd+CupC0Nk1Bg2CGGOIqwVK7IVZpDmaHCIP4q2Z jenkins" > .ssh/authorized_keys && chmod 640 .ssh/authorized_keys' ||
		exit 1
		;;

	freebsd*)
		(
			cd ~jenkins &&
			sudo -nA mkdir -p .ssh &&
			sudo -nA chown jenkins:jenkins .ssh &&
			sudo -nA chmod 700 .ssh &&
			echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn13u8LWKtP+4e7nQ1RQOsxbGA/fls85h7YjACS/0EdrCFLP2q5BlbevEXAXTt65MdyawD1VLy7cskulkoTHxvBTzsZh44kYRSzR0FIxla4IHK9FcJJHrWqmLUegRett1Mnrr4VIruriNfwyM923vNEOdiDeRfDcpcYstMoQ+uEI6YI0qrC8BjbY0HysCGV+3N0AjE39vlLfpvWdMBtgf5PFlsgBvCD36k2kB+MDFo37qrJfEEtHhXJYh52BGXeoUdbivkBp2Z2q+a4b9xvKuqwPi/aCn2ILXKcPUDSPv4wUwEpVd+CupC0Nk1Bg2CGGOIqwVK7IVZpDmaHCIP4q2Z jenkins" | sudo -nA tee .ssh/authorized_keys >/dev/null &&
			sudo -nA chmod 640 .ssh/authorized_keys
		) ||
		exit 1
		;;

	*)
		exit 1
		;;
esac

case "$DISTRIBUTION" in
	sunos)
		echo user jenkins sunos
		sudo -nA su - jenkins -c 'rm -f .bashrc && echo "export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/mysql/bin" > .bashrc' ||
		exit 1
		;;
esac

echo user jenkins ccache
case "$DISTRIBUTION" in
	ubuntu|redhat|centos|suse)
		sudo -nA su - -c 'ccache -M 500M && ccache -c' jenkins ||
		exit 1
		;;

	freebsd*)
		sudo -nA su - jenkins -c 'ccache -M 500M && ccache -c' ||
		exit 1
		;;

	sunos)
		;;

	*)
		exit 1
		;;
esac

echo user jenkins chmod home
case "$DISTRIBUTION" in
	ubuntu|redhat|centos|suse)
		sudo -nA su - -c 'chmod a+rx $HOME' jenkins ||
		exit 1
		;;

	freebsd*|sunos)
		sudo -nA su - jenkins -c 'chmod a+rx $HOME' ||
		exit 1
		;;

	*)
		exit 1
		;;
esac

#
# readonly user
#

echo user readonly create
if ! grep -q '^readonly:' /etc/passwd; then
	case "$DISTRIBUTION" in
		ubuntu|redhat|centos|suse|sunos)
			sudo -nA useradd -m readonly ||
			exit 1
			;;

		freebsd*)
			echo 'readonly::::::::/bin/sh:' | sudo -nA adduser -w no -f - ||
			exit 1
			;;

		*)
			exit 1
			;;
	esac
fi

echo user readonly key setup
case "$DISTRIBUTION" in
	ubuntu|redhat|centos|suse)
		sudo -nA su - -c 'mkdir -p .ssh && chmod 700 .ssh && rm -f .ssh/authorized_keys && touch .ssh/authorized_keys && chmod 640 .ssh/authorized_keys' readonly ||
		exit 1
		;;

	sunos)
		sudo -nA su - readonly -c 'mkdir -p .ssh && chmod 700 .ssh && rm -f .ssh/authorized_keys && touch .ssh/authorized_keys && chmod 640 .ssh/authorized_keys' ||
		exit 1
		;;

	freebsd*)
		(
			cd ~readonly &&
			sudo -nA mkdir -p .ssh &&
			sudo -nA chown readonly:readonly .ssh &&
			sudo -nA chmod 700 .ssh &&
			sudo -nA rm -f .ssh/authorized_keys &&
			sudo -nA touch .ssh/authorized_keys &&
			sudo -nA chmod 640 .ssh/authorized_keys
		) ||
		exit 1
		;;

	*)
		exit 1
		;;
esac

echo user readonly keys
for key in keys/*; do
	if [ "$key" = "keys/*" ]; then
		break
	fi

	echo "# $key" | sudo -nA tee -a ~readonly/.ssh/authorized_keys >/dev/null &&
	cat -- "$key" | sudo -nA tee -a ~readonly/.ssh/authorized_keys >/dev/null ||
	exit 1
done

case "$DISTRIBUTION" in
	sunos)
		echo user readonly sunos
		sudo -nA su - readonly -c 'rm -f .bashrc && echo "export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/mysql/bin" > .bashrc' ||
		exit 1
		;;
esac

#
# syslog
#
echo syslog
case "$DISTRIBUTION" in
	ubuntu)
		if ! grep -B 1 -A 1 '^\*\.\*;auth,authpriv\.none[ 	]*-/var/log/syslog$' /etc/rsyslog.d/50-default.conf | grep -q '^$FileCreateMode'; then
			sudo -nA sed -i 's%^\(\*\.\*;auth,authpriv\.none[ 	]*-/var/log/syslog\)$%$FileCreateMode 0644\n\1\n$FileCreateMode 0640%' /etc/rsyslog.d/50-default.conf &&
			sudo -nA chmod o+r /var/log/syslog ||
			exit 1
			REBOOT=1
		fi
		if [ ! -f /etc/rsyslog.d/00-opendnssec.conf ]; then
			echo -e '$IMUXSockRateLimitInterval 0\n$SystemLogRateLimitInterval 0' | sudo -nA tee -a /etc/rsyslog.d/00-opendnssec.conf >/dev/null ||
			exit 1
			REBOOT=1
		fi
		;;

	redhat|centos)
		if ! grep -B 1 -A 1 '^\*\.\(info\|\*\);mail\.none;authpriv\.none;cron\.none[ 	]*/var/log/messages$' /etc/rsyslog.conf | grep -q '^$FileCreateMode'; then
			sudo -nA sed -i 's%^\*\.\(info\|\*\)\(;mail\.none;authpriv\.none;cron\.none[ 	]*/var/log/messages\)$%$FileCreateMode 0644\n*.*\2\n$FileCreateMode 0640%' /etc/rsyslog.conf &&
			sudo -nA chmod a+r /var/log/messages ||
			exit 1
			REBOOT=1
		fi
		if [ ! -f /etc/rsyslog.d/00-opendnssec.conf ]; then
			echo -e '$IMUXSockRateLimitInterval 0\n$SystemLogRateLimitInterval 0' | sudo -nA tee -a /etc/rsyslog.d/00-opendnssec.conf >/dev/null ||
			exit 1
			REBOOT=1
		fi
		;;

	freebsd*)
		if grep -q '^\*\.notice;authpriv\.none;kern\.debug;lpr\.info;mail\.crit;news\.err[ 	]/var/log/messages$' /etc/syslog.conf; then
			sudo -nA sed -i '' -e 's%^\*\.notice;authpriv\.none;kern\.debug;lpr\.info;mail\.crit;news\.err[ 	]/var/log/messages$%daemon.*;local0.*;local1.*;authpriv.none;lpr.info;mail.crit;news.err	/var/log/messages%' /etc/syslog.conf ||
			exit 1
			REBOOT=1
		fi
		;;

	sunos)
		if grep -q '^\*\.err;kern\.debug;daemon\.notice;mail\.crit[	]*/var/adm/messages$' /etc/syslog.conf; then
			sudo -nA gsed -i -e 's%\*\.err;kern\.debug;daemon\.notice;mail\.crit[	]*/var/adm/messages%*.debug			/var/adm/messages%' /etc/syslog.conf ||
			exit 1
			REBOOT=1
		fi
		;;

	suse)
		if grep -q '^destination messages { file("/var/log/messages"); };$' /etc/syslog-ng/syslog-ng.conf; then
			sudo -nA sed -i 's%^destination messages { file("/var/log/messages"); };$%destination messages { file("/var/log/messages" perm(0644)); };%' /etc/syslog-ng/syslog-ng.conf ||
			exit 1
			REBOOT=1
		fi
		if grep -q 'create 640' /etc/logrotate.d/syslog; then
			sudo -nA sed -i 's%create 640%create 644%' /etc/logrotate.d/syslog ||
			exit 1
			REBOOT=1
		fi
		sudo -nA chmod o+r /var/log/messages ||
		exit 1
		;;
esac

#
# sshd
#

echo sshd
case "$DISTRIBUTION" in
	freebsd*)
		if sudo -nA grep '^PermitRootLogin' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA sed -i '' -e 's%^\(PermitRootLogin\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;

	sunos)
		if sudo -nA grep '^PermitRootLogin' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA gsed -i -e 's%^\(PermitRootLogin\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;

	*)
		if sudo -nA grep '^PermitRootLogin' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA sed -i 's%^\(PermitRootLogin\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;
esac
if ! sudo -nA grep -q '^PermitRootLogin no' $SSHD_CONF; then
	sudo -nA echo "PermitRootLogin no" | sudo -nA tee -a $SSHD_CONF >/dev/null ||
	exit 1
	REBOOT=1
fi
case "$DISTRIBUTION" in
	freebsd*)
		if sudo -nA grep '^PasswordAuthentication' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA sed -i '' - e 's%^\(PasswordAuthentication\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;

	sunos)
		if sudo -nA grep '^PasswordAuthentication' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA gsed -i -e 's%^\(PasswordAuthentication\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;

	*)
		if sudo -nA grep '^PasswordAuthentication' $SSHD_CONF | grep -q 'yes'; then
			sudo -nA sed -i 's%^\(PasswordAuthentication\)%#\1%g' $SSHD_CONF ||
			exit 1
			REBOOT=1
		fi
		;;
esac
if ! sudo -nA grep -q '^PasswordAuthentication no' $SSHD_CONF; then
	echo "PasswordAuthentication no" | sudo -nA tee -a $SSHD_CONF >/dev/null ||
	exit 1
	REBOOT=1
fi

#
# firewall
#

echo firewall
case "$DISTRIBUTION" in
	ubuntu)
		sudo -nA ufw allow from any to any port 22 &&
		echo y | sudo -nA ufw enable ||
		exit 1
		;;

	freebsd*)
		sha=""
		if [ -f /etc/ipf.rules ]; then
			sha=`sha1 -q /etc/ipf.rules`
			if [ -z "$sha" ]; then
				exit 1
			fi
		fi
		if [ "$sha" != "c2f7f78f3ee6ebd7bd5a04e7888922d63156d1fd" ]; then
			sudo -nA rm -f /etc/ipf.rules &&
			echo -e "block in all\npass in from any to port = 22 keep state\npass in on lo keep state\npass out all keep state" | sudo -nA tee /etc/ipf.rules >/dev/null ||
			exit 1
			sha=`sha1 -q /etc/ipf.rules`
			if [ -z "$sha" ]; then
				exit 1
			fi
			if [ "$sha" != "c2f7f78f3ee6ebd7bd5a04e7888922d63156d1fd" ]; then
				echo "ipf.rules sha missmatch"
				exit 1
			fi
			REBOOT=1
		fi
		
		freebsd_rc_conf_enable_yes ipfilter
		if ! grep -q '^ipfilter_rules="/etc/ipf.rules"' /etc/rc.conf; then
			echo 'ipfilter_rules="/etc/ipf.rules"' | sudo -nA tee -a /etc/rc.conf >/dev/null ||
			exit 1
			REBOOT=1
		fi
		;;

	sunos)
		sha=""
		if [ -f /etc/ipf/ipf.conf ]; then
			sha=`sha1sum /etc/ipf/ipf.conf | awk '{print $1}'`
			if [ -z "$sha" ]; then
				exit 1
			fi
		fi
		if [ "$sha" != "c2f7f78f3ee6ebd7bd5a04e7888922d63156d1fd" ]; then
			sudo -nA rm -f /etc/ipf/ipf.conf &&
			echo -e "block in all\npass in from any to port = 22 keep state\npass in on lo keep state\npass out all keep state" | sudo -nA tee /etc/ipf/ipf.conf >/dev/null ||
			exit 1
			sha=`sha1sum /etc/ipf/ipf.conf | awk '{print $1}'`
			if [ -z "$sha" ]; then
				exit 1
			fi
			if [ "$sha" != "c2f7f78f3ee6ebd7bd5a04e7888922d63156d1fd" ]; then
				echo "ipf.conf sha missmatch"
				exit 1
			fi
			REBOOT=1
		fi
		;;
esac

#
# Reboot if needed
#

echo reboot
if [ "$REBOOT" = "1" ]; then
	case "$DISTRIBUTION" in
		ubuntu|redhat|centos|suse|freebsd*)
			nohup sudo -nA shutdown -r +1 >/dev/null 2>/dev/null </dev/null &
			;;

		sunos)
			nohup sudo -nA shutdown -y -r -g 60 "reboot" >/dev/null 2>/dev/null </dev/null &
			;;
	esac
	echo "DONE REBOOT"
	exit 0
fi

echo "DONE"
exit 0