domains.ext

@@ -5,4 +5,3 @@ subjectAltName = @alt_names
 [alt_names]
 DNS.1 = sutty.local
 DNS.2 = *.sutty.local
-DNS.3 = *.tienda.sutty.local

haini.sh

@@ -8,7 +8,6 @@ uname -m | grep -q x86_64 || exit 1
 DIR="$(dirname "$(realpath "$0")")"
 ROOT="$(dirname "$DIR")"
 SELF="$(basename "$0")"
-SSH_ADHOC=false
 
 # Sólo se puede correr desde el directorio de Sutty
 if test "$ROOT" != "$(dirname "$PWD")" && test "$ROOT" != "$PWD"; then
@@ -21,7 +20,7 @@ if ! test "$HAIN_ENV" && ! type bwrap >/dev/null 2>&1 ; then
   exit 1
 fi
 
-if test -f /proc/sys/kernel/unprivileged_userns_clone && test "$(cat /proc/sys/kernel/unprivileged_userns_clone)" -ne 1 ; then
+if test "$(sysctl -n kernel.unprivileged_userns_clone)" -ne 1 ; then
   echo "Necesitamos configurar tu sistema, ingresa tu contraseña para correr el comando" >&2
   echo "sudo sysctl -a kernel.unprivileged_userns_clone=1" >&2
   sudo sysctl -a kernel.unprivileged_userns_clone=1
@@ -41,38 +40,26 @@ ENTORNO=${ENTORNO:-${ROOT}/hain}
 correr() {
   echo "> $1" >&2
 
-  if test "$AS_ROOT"; then
-    SET_UID=0
-    SET_GID=0
-  else
-    SET_UID="$(id -u)"
-    SET_GID="$(id -g)"
-  fi
-
   env -i \
-    DISPLAY="$DISPLAY" \
     TERM="$TERM" \
-    USER="suttier" \
+    USER="$USER" \
     HOME="/home/suttier" \
     HAIN_ENV=true \
     RAILS_ENV="${RAILS_ENV:-development}" \
     JEKYLL_ENV="${JEKYLL_ENV:-development}" \
-    $(test -f "$ENV_FILE" && (grep -v '^#' "$ENV_FILE" | xargs -0) || true) \
     EDITOR="nano" \
     PAGER="less -niSFX" \
-    SSH_AUTH_SOCK="${SSH_AUTH_SOCK}" \
     bwrap \
     --die-with-parent \
-    --unshare-user \
+    --unshare-user-try \
-    --uid "$SET_UID" \
-    --gid "$SET_GID" \
     --unshare-ipc \
     --unshare-uts \
     --unshare-cgroup-try \
     --bind "$ENTORNO" / \
     --bind "$ROOT" /Sutty \
-    $(test -f ~/.Xauthority && echo "--ro-bind $HOME/.Xauthority /home/suttier/.Xauthority") \
     --ro-bind /etc/hosts /etc/hosts \
+    --ro-bind /etc/passwd /etc/passwd \
+    --ro-bind /etc/group /etc/group \
     --ro-bind /etc/resolv.conf /etc/resolv.conf \
     --ro-bind /etc/localtime /etc/localtime \
     --dev-bind /dev /dev \
@@ -119,7 +106,7 @@ generar_certificado() {
     -keyout $domain_key -out $domain_csr \
     -subj '/C=AR/ST=Ninguno/L=Interdimension/O=Sutty-Local/CN=sutty.local'"
   correr "openssl x509 -req -sha256 -days 3650 \
-    -in $domain_csr -CA $ca_crt -CAkey $ca_key \
+    -in $domain_csr -CA $ca_crt.pem -CAkey $ca_key \
     -CAcreateserial -extfile /Sutty/haini.sh/domains.ext -out $domain_crt"
 
   rm "$ENTORNO$ca_crt.pem"
@@ -182,22 +169,6 @@ crear_entorno() {
     && mv "$ENTORNO$HOME" "$ENTORNO/home/suttier"
   mkdir -p "$ENTORNO/home/suttier"
 
-  if ! grep ^suttier: "$ENTORNO/etc/group" >/dev/null 2>&1 ; then
-    AS_ROOT=true correr "addgroup \
-      -g $(id -g) \
-      suttier"
-  fi
-  if ! correr "id suttier" >/dev/null 2>&1 ; then
-    AS_ROOT=true correr "adduser \
-      --disabled-password \
-      --gecos '' \
-      --home /home/suttier \
-      --no-create-home \
-      --uid $(id -u) \
-      --ingroup suttier \
-      suttier"
-  fi
-
   # Configurar rubygems para que descargue las gemas desde Sutty
   install -m 640 "$DIR/.gemrc" "$ENTORNO/home/suttier/.gemrc"
 
@@ -209,37 +180,10 @@ crear_entorno() {
     install -m 755 "$script" "$ENTORNO/usr/local/bin/${script##*/}"
   done
 
-  # Configurar SSH
-  install -m 700 -d "$ENTORNO/home/suttier/.ssh"
-  install -m 644 "$DIR/ssh/known_hosts" "$ENTORNO/home/suttier/.ssh/known_hosts"
-
   test -f "$ENTORNO/etc/ssl/certs/sutty.local.crt" || generar_certificado
   test -f "$ENTORNO/usr/local/share/ca-certificates/ca-sutty.crt" || mv "$ENTORNO/etc/ssl/certs/ca-sutty.crt" "$ENTORNO/usr/local/share/ca-certificates/ca-sutty.crt"
 }
 
-# Auto-actualizar una vez por hora
-actualizar() {
-  test ! "$TERM" = "dumb" || return
-
-  last_update="$(find "$DIR/.git/FETCH_HEAD" -mmin +60 | wc -l)"
-
-  if test ! $last_update -ne 0; then
-    return
-  fi
-
-  echo -n "Actualizando haini.sh... " >&2
-  if ping -q -c 1 0xacab.org >/dev/null 2>&1; then
-    git -C "$DIR" pull --ff-only
-
-    if test "$DIR/.git/FETCH_HEAD" -ot "$DIR/.git/ORIG_HEAD"; then
-      echo "haini.sh se actualizó, por favor volvé a ejecutar el comando" >&2
-      exit 0
-    fi
-  else
-    echo "no se pudo conectar 0xacab.org, intentando la próxima vez." >&2
-  fi
-}
-
 DEFAULT="sh"
 
 case $1 in
@@ -259,23 +203,6 @@ esac
 if test "$HAIN_ENV"; then
   ${*:-$DEFAULT}
 else
-  if test -z "${SSH_AUTH_SOCK}"; then
-    if ! type ssh-agent >/dev/null 2>&1 ; then
-      echo "Instala ssh-agent para poder trabajar con git remoto dentro de haini.sh" >&2
-    else
-      SSH_ADHOC=true
-
-      echo "Iniciando un ssh-agent temporal." >&2
-      eval "$(ssh-agent)"
-      ssh-add
-    fi
-  fi
-
-  actualizar
   crear_entorno
-  stdin="$(test "$TERM" = "dumb" || echo "/dev/stdin")" correr "${*:-$DEFAULT}" ; salida=$?
+  stdin=/dev/stdin correr "${*:-$DEFAULT}"
-
-  ${SSH_ADHOC} && ssh-agent -k
-
-  exit $salida
 fi

nginx.conf

@@ -9,10 +9,6 @@ server {
 
   add_header Cache-Control "no-store; max-age=0";
 
-  location ~ /../assets/js/pack.js {
-    rewrite ^ /assets/js/pack.js last;
-  }
-
   location /assets/js/pack.js {
     proxy_pass http://127.0.0.1:65001;
   }
@@ -27,5 +23,3 @@ server {
     proxy_pass http://127.0.0.1:65001;
   }
 }
-
-include /Sutty/*-jekyll-theme/_nginx.conf;

packages

@@ -4,7 +4,6 @@ ffmpeg
 file
 git
 git-lfs
-jpegoptim
 less
 libssh2
 libxml2
@@ -15,10 +14,7 @@ nano-syntax
 ncurses-terminfo
 nginx
 nodejs
-npm
-openssh-client
 openssl
-oxipng
 postgresql
 postgresql-contrib
 postgresql-libs

ssh/known_hosts

@@ -1,3 +0,0 @@
-0xacab.org,198.252.153.239 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdh69MJNIA4hZNdplalK1BOD4QZEKn8msMwsEzA7nrr
-athshe.sutty.nl,172.96.172.58 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIDqJl9IW6WXAxrtZXMzvMnIpTjIZB+Tp+dDUpSaOrqdjqdMVjHVQSFnVh0MLHbvdjKKtxaKDAuT3JXGrSp8wyA=
-anarres.sutty.nl,54.39.161.205 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGw9aXovdiR44WzGfaitjlGiAO7I5OP/XgxFEc+t6HWeS0oqIVaEo17y7j29hLZbTRpN8vWoGSMa+UtquQZ6JG8=