X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=conflink;h=e26be58e0693af8d3ce3ddb9e84bdba8a8e1f636;hp=4e62edbcc39469d44b66336ba1dbff81321f094a;hb=8a6b446c7e336596af614c853e1c6177e55a7983;hpb=2d3ce30754a3f24d922635647bab4990b60f5c27

diff --git a/conflink b/conflink
index 4e62edb..e26be58 100755
--- a/conflink
+++ b/conflink
@@ -63,25 +63,30 @@ common-file-setup() {
 all_dirs=({/a/c,/p/c}{,/machine_specific/$HOSTNAME})
 # note, we assume a group of hosts does not have the
 # same name as a single host, which is no problem on our scale.
-for x in /p/c/machine_specific/*.hosts; do
+for x in /p/c/machine_specific/*.hosts /a/bin/ds/machine_specific/*.hosts; do
   if grep -qxF $HOSTNAME $x; then all_dirs+=( ${x%.hosts} ); fi
 done
 
 c_dirs=(/a/c{,/machine_specific/$HOSTNAME})
 case $USER in
-  ian|iank)
+  iank)
+    files=(/p/c/machine_specific/*/filesystem/etc/ssh/*_key)
+    if [[ -e $files ]]; then
+      chmod 600 ${files[@]}
+    fi
     # p needs to go first so .ssh link is created, then config link inside it
     m common-file-setup ${all_dirs[@]}
 
     #### begin special extra stuff ####
     install -d -m700 ~/gpg-agent-socket
 
-    files=(/var/lib/bind)
-    if [[ -e $files ]]; then
+    f=/var/lib/bind
+    if [[ -e $f ]]; then
       # reset to the original permissions.
-      m s chgrp -R bind ${files[@]}
-      m s chmod g+w ${files[@]}
+      m s chgrp -R bind $f
+      m s chmod g+w $f
     fi
+    sudo bash -c 'shopt -s nullglob; for f in /etc/bind/*.key /etc/bind/*.private /etc/bind/key.*; do chgrp bind $f; done'
     if [[ -e /etc/davpass ]] && getent group www-data &>/dev/null; then
       s chgrp www-data /etc/davpass
     fi
@@ -89,10 +94,19 @@ case $USER in
       s chown -R znc:znc /var/lib/znc
     fi
     /a/exe/lnf -T /p/arbtt-capture.log ~/.arbtt/capture.log
+    f=/etc/prometheus-htpasswd
+    if [[ -e $f ]]; then
+      s chmod 640 $f /etc/prometheus-pass
+      s chown root:www-data $f
+      if getent passwd prometheus; then
+        s chown root:prometheus /etc/prometheus-pass
+      fi
+    fi
+
     ##### end special extra stuff #####
 
-    sudo bash -c 'cd /etc/openvpn; for f in client/*; do ln -sf $f .; done'
-    sudo bash -c 'chmod 600 /etc/openvpn/client/*.key'
+    sudo bash -c 'shopt -s nullglob; cd /etc/openvpn; for f in client/* server/*; do ln -sf $f .; done'
+    sudo bash -c 'shopt -s nullglob; cd /etc/openvpn; for f in server/*.key client/*.key; do chmod 600 $f; done'
 
     m sudo -H -u traci "$BASH_SOURCE"
     ;;