From fce30d287593f1c41676f3af7e4b98613a197ae8 Mon Sep 17 00:00:00 2001
From: Kristof Provost <kp@FreeBSD.org>
Date: Wed, 3 May 2023 22:01:15 +0200
Subject: [PATCH] Initial overlay for domotica machines

* Console over serial port
* set up 'kp' user & sudo
* crontab presence announcement to sigsegv.be with mac address
* ssh-able as kp
---
 image/overlay/domotica/boot/loader.conf       |   4 +
 image/overlay/domotica/etc/rc.conf            |   9 ++
 image/overlay/domotica/etc/rc.d/ansibleprep   |  27 +++++
 image/overlay/domotica/firstboot              |   1 +
 .../domotica/home/kp/.ssh/authorized_keys     |   1 +
 image/overlay/domotica/home/kp/.zshrc         |   1 +
 .../domotica/home/kp/bin/announce_presence    |   5 +
 image/overlay/domotica/home/kp/bin/utils.subr |  11 ++
 image/overlay/domotica/usr/local/etc/sudoers  | 110 ++++++++++++++++++
 image/overlay/domotica/var/cron/tabs/kp       |   1 +
 10 files changed, 170 insertions(+)
 create mode 100644 image/overlay/domotica/boot/loader.conf
 create mode 100644 image/overlay/domotica/etc/rc.conf
 create mode 100755 image/overlay/domotica/etc/rc.d/ansibleprep
 create mode 100644 image/overlay/domotica/firstboot
 create mode 100644 image/overlay/domotica/home/kp/.ssh/authorized_keys
 create mode 100644 image/overlay/domotica/home/kp/.zshrc
 create mode 100755 image/overlay/domotica/home/kp/bin/announce_presence
 create mode 100644 image/overlay/domotica/home/kp/bin/utils.subr
 create mode 100644 image/overlay/domotica/usr/local/etc/sudoers
 create mode 100644 image/overlay/domotica/var/cron/tabs/kp

diff --git a/image/overlay/domotica/boot/loader.conf b/image/overlay/domotica/boot/loader.conf
new file mode 100644
index 0000000..7035712
--- /dev/null
+++ b/image/overlay/domotica/boot/loader.conf
@@ -0,0 +1,4 @@
+console="comconsole,vidconsole"
+comconsole_speed="115200"
+boot_multicons="YES"
+boot_serial="YES"
diff --git a/image/overlay/domotica/etc/rc.conf b/image/overlay/domotica/etc/rc.conf
new file mode 100644
index 0000000..8fa2a5f
--- /dev/null
+++ b/image/overlay/domotica/etc/rc.conf
@@ -0,0 +1,9 @@
+ansibleprep_enable="YES"
+
+sshd_enable="YES"
+sendmail_enable="NONE"
+ntpdate_enable="YES"
+ntpd_enable="YES"
+
+ifconfig_em0="DHCP"
+ifconfig_igb0="DHCP"
diff --git a/image/overlay/domotica/etc/rc.d/ansibleprep b/image/overlay/domotica/etc/rc.d/ansibleprep
new file mode 100755
index 0000000..9d2632b
--- /dev/null
+++ b/image/overlay/domotica/etc/rc.d/ansibleprep
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+
+# PROVIDE: ansibleprep
+# REQUIRE: DAEMON
+# BEFORE: LOGIN
+# KEYWORD: firstboot
+
+. /etc/rc.subr
+
+name="ansibleprep"
+start_cmd="ansibleprep_start"
+
+ansibleprep_start()
+{
+	# Just enough so kp can log in
+	pw user add kp
+	pw user mod kp -s /usr/local/bin/zsh
+	chown -R kp /home/kp
+	chmod 700 /home/kp/.ssh
+
+	# And sudo should work for ansible
+	chown root:wheel /usr/local/etc/sudoers
+}
+
+load_rc_config $name
+run_rc_command "$1"
diff --git a/image/overlay/domotica/firstboot b/image/overlay/domotica/firstboot
new file mode 100644
index 0000000..792d600
--- /dev/null
+++ b/image/overlay/domotica/firstboot
@@ -0,0 +1 @@
+#
diff --git a/image/overlay/domotica/home/kp/.ssh/authorized_keys b/image/overlay/domotica/home/kp/.ssh/authorized_keys
new file mode 100644
index 0000000..62f8adc
--- /dev/null
+++ b/image/overlay/domotica/home/kp/.ssh/authorized_keys
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCPmLVO+sYPkQm36cUDpWcYNC4l7t56YQIEFxGXIUBAgvnzhyYxKpQhpLea0BdnQXzDcqrEGjbIezgBQc3X2qVT3i53lvngtlGMheOMT0LrRXmHj1xUfdSzCgvu+STW+btJ0gq9A5iFI47HsZBExiE9pFBMoBC6uiicS9R5NvtE+Axl5cykX36Sq1vneDKu/dFZvmaiCGxXl77ed7aoLUZQpU+6r1r2IN2Yx6b9jK5m9aUk4HS9+IG3xUAjfK2PPLmxYafiKrbzMD9AhsFqGdnASK5jmspJ47wx3NFpAdnOFijQVQdYMgTEeOqO3tNSyF7Y9IA/kgkzpzPZCcqZH+PCpHSN2LZMRrUxDPdPVPIxboRAY0Q1uZ8iBDXILyhvpJr1DP0zomRE65/4VpIeuVqsyOLD3WdG1lHcK+bzpTT1JTQWNaxe3MwvAc67BItoflutuWZFlytvqr7zyJirCyUJuD0L0j/CTC5O635QQT3sDjQLXLn/T6SsbsRdt4eA2pKX8T95dLS8onPLa7GwUXwEupp5+aUi1G8PchImOv27tcG5yuRcbECosoL/OedX2y0dAP4Eafg9cJMR++h8p4NuhjeYQYxhnpVVhCidRPCSZ7Exj/UpNo/quLvCdFu3nLuAPzfk8NclO5V7jd7WMYiJm0XgKHIWKkD8cfmLWbcrw== GPG SSH key (Yubikey new horizons) (F6532E2ECB7D6E930A8A5B1AA76D86379FFA151A)
diff --git a/image/overlay/domotica/home/kp/.zshrc b/image/overlay/domotica/home/kp/.zshrc
new file mode 100644
index 0000000..792d600
--- /dev/null
+++ b/image/overlay/domotica/home/kp/.zshrc
@@ -0,0 +1 @@
+#
diff --git a/image/overlay/domotica/home/kp/bin/announce_presence b/image/overlay/domotica/home/kp/bin/announce_presence
new file mode 100755
index 0000000..6fd2e9a
--- /dev/null
+++ b/image/overlay/domotica/home/kp/bin/announce_presence
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+. /home/kp/bin/utils.subr
+
+timeout 5 fetch https://www.sigsegv.be/domotica/pennestraat/$(host_id)
diff --git a/image/overlay/domotica/home/kp/bin/utils.subr b/image/overlay/domotica/home/kp/bin/utils.subr
new file mode 100644
index 0000000..a3d9811
--- /dev/null
+++ b/image/overlay/domotica/home/kp/bin/utils.subr
@@ -0,0 +1,11 @@
+mac()
+{
+        intf=$1
+
+        ifconfig ${intf} | awk '/ether/ { printf($2); }'
+}
+
+host_id()
+{
+        mac "em0"
+}
diff --git a/image/overlay/domotica/usr/local/etc/sudoers b/image/overlay/domotica/usr/local/etc/sudoers
new file mode 100644
index 0000000..e2d46a6
--- /dev/null
+++ b/image/overlay/domotica/usr/local/etc/sudoers
@@ -0,0 +1,110 @@
+## sudoers file.
+##
+## This file MUST be edited with the 'visudo' command as root.
+## Failure to use 'visudo' may result in syntax or file permission errors
+## that prevent sudo from running.
+##
+## See the sudoers man page for the details on how to write a sudoers file.
+##
+
+##
+## Host alias specification
+##
+## Groups of machines. These may include host names (optionally with wildcards),
+## IP addresses, network numbers or netgroups.
+# Host_Alias	WEBSERVERS = www1, www2, www3
+
+##
+## User alias specification
+##
+## Groups of users.  These may consist of user names, uids, Unix groups,
+## or netgroups.
+# User_Alias	ADMINS = millert, dowdy, mikef
+
+##
+## Cmnd alias specification
+##
+## Groups of commands.  Often used to group related commands together.
+# Cmnd_Alias	PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
+# 			    /usr/bin/pkill, /usr/bin/top
+# Cmnd_Alias	REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff
+
+##
+## Defaults specification
+##
+## Uncomment if needed to preserve environmental variables related to the
+## FreeBSD pkg utility and fetch.
+# Defaults     env_keep += "PKG_CACHEDIR PKG_DBDIR FTP_PASSIVE_MODE"
+##
+## Additionally uncomment if needed to preserve environmental variables
+## related to portupgrade
+# Defaults     env_keep += "PORTSDIR PORTS_INDEX PORTS_DBDIR PACKAGES PKGTOOLS_CONF"
+##
+## You may wish to keep some of the following environment variables
+## when running commands via sudo.
+##
+## Locale settings
+# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
+##
+## Run X applications through sudo; HOME is used to find the
+## .Xauthority file.  Note that other programs use HOME to find   
+## configuration files and this may lead to privilege escalation!
+# Defaults env_keep += "HOME"
+##
+## X11 resource path settings
+# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
+##
+## Desktop path settings
+# Defaults env_keep += "QTDIR KDEDIR"
+##
+## Allow sudo-run commands to inherit the callers' ConsoleKit session
+# Defaults env_keep += "XDG_SESSION_COOKIE"
+##
+## Uncomment to enable special input methods.  Care should be taken as
+## this may allow users to subvert the command being run via sudo.
+# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
+##
+## Uncomment to use a hard-coded PATH instead of the user's to find commands
+# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+##
+## Uncomment to send mail if the user does not enter the correct password.
+# Defaults mail_badpass
+##
+## Uncomment to enable logging of a command's output, except for
+## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
+# Defaults log_output
+# Defaults!/usr/bin/sudoreplay !log_output
+# Defaults!/usr/local/bin/sudoreplay !log_output
+# Defaults!REBOOT !log_output
+
+##
+## Runas alias specification
+##
+
+##
+## User privilege specification
+##
+root ALL=(ALL) ALL
+
+## Uncomment to allow members of group wheel to execute any command
+# %wheel ALL=(ALL) ALL
+
+## Same thing without a password
+# %wheel ALL=(ALL) NOPASSWD: ALL
+kp ALL=(ALL) NOPASSWD: ALL
+Defaults     env_keep += "SSH_AUTH_SOCK"
+
+## Uncomment to allow members of group sudo to execute any command
+# %sudo	ALL=(ALL) ALL
+
+## Uncomment to allow any user to run sudo if they know the password
+## of the user they are running the command as (root by default).
+# Defaults targetpw  # Ask for the password of the target user
+# ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
+
+## Uncomment to show on password prompt which users' password is being expected
+# Defaults passprompt="%p's password:"
+
+## Read drop-in files from /usr/local/etc/sudoers.d
+## (the '#' here does not indicate a comment)
+#includedir /usr/local/etc/sudoers.d
diff --git a/image/overlay/domotica/var/cron/tabs/kp b/image/overlay/domotica/var/cron/tabs/kp
new file mode 100644
index 0000000..859c03b
--- /dev/null
+++ b/image/overlay/domotica/var/cron/tabs/kp
@@ -0,0 +1 @@
+1 * * * * /home/kp/bin/announce_presence
-- 
2.51.0