initial commit

.gitignore

@@ -0,0 +1,9 @@
+
+# - common
+*.log
+*.swp
+conf/*.conf
+
+crontab-*
+
+temporary-login-credentials.txt

add-cron-for-checking-cert.sh

@@ -0,0 +1,228 @@
+#!/usr/bin/env bash
+
+script_name="$(basename $(realpath $0))"
+working_dir="$(dirname $(realpath $0))"
+
+#conf_file="${working_dir}/conf/${script_name%%.*}.conf"
+conf_file="${working_dir}/conf/keycloak.conf"
+
+LOCK_DIR="/tmp/$(basename $0).$$.LOCK"
+log_file="${LOCK_DIR}/${script_name%%.*}.log"
+
+backup_date="$(date +%Y-%m-%d-%H%M)"
+
+crontab_backup_file="${script_dir}/crontab-root-${backup_date}"
+
+
+# ----------
+# Base Function(s)
+# ----------
+
+clean_up() {
+
+   if [[ -f "$crontab_backup_file" ]]; then
+      echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.."
+      crontab $_backup_crontab_file > $log_file 2>&1
+      if [[ $? -eq 0 ]]; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+
+   # Perform program exit housekeeping
+   rm -rf "$LOCK_DIR"
+   blank_line
+   exit $1
+}
+
+echononl(){
+   if $terminal ; then
+      echo X\\c > /tmp/shprompt$$
+      if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+         echo -e -n "   $*\\c" 1>&2
+      else
+         echo -e -n "   $*" 1>&2
+      fi
+      rm /tmp/shprompt$$
+   fi
+}
+
+fatal(){
+   if $terminal ; then
+      echo ""
+      echo -e "   [ \033[31m\033[1mFatal\033[m ] $*"
+      echo ""
+      echo -e "             \033[1mScript is canceled\033[m.."
+      echo ""
+   else
+      echo ""
+      echo -e "   [ Fatal ] $*"
+      echo ""
+      echo -e "             Script is canceled.."
+      echo ""
+   fi
+   if [[ -f "$crontab_backup_file" ]]; then
+      echononl "Reenable previously saved crontab from '$(basename "${crontab_backup_file}")'.."
+      crontab $_backup_crontab_file > $log_file 2>&1
+      if [[ $? -eq 0 ]]; then
+         echo_ok
+      else
+         echo_failed
+         error "$(cat $log_file)"
+      fi
+   fi
+
+   rm -rf $LOCK_DIR
+   exit 1
+}
+
+error (){
+   echo ""
+   if $terminal ; then
+      echo -e "   [ \033[31m\033[1mError\033[m ] $*"
+   else
+      echo "   [ Error ] $*"
+   fi
+   echo ""
+}
+
+warn (){
+   echo ""
+   if $terminal ; then
+      echo -e "   [ \033[33m\033[1mWarning\033[m ] $*"
+   else
+      echo "   [ Error ] $*"
+   fi
+   echo ""
+}
+
+info (){
+   if $terminal ; then
+      echo ""
+      if $terminal ; then
+         echo -e "   [ \033[32m\033[1mInfo\033[m ]  $*"
+      else
+         echo "   [ Info ]  $*"
+      fi
+      echo ""
+   fi
+}
+
+
+echo_ok() {
+   if $terminal ; then
+      echo -e "\033[85G[ \033[32mok\033[m ]"
+   fi
+}
+echo_failed(){
+   if $terminal ; then
+      echo -e "\033[85G[ \033[1;31mfailed\033[m ]"
+   fi
+}
+echo_skipped() {
+   if $terminal ; then
+      echo -e "\033[85G[ \033[33m\033[1mskipped\033[m ]"
+   fi
+}
+echo_wait(){
+   if $terminal ; then
+      echo -en "\033[85G[ \033[5m\033[1m..\033[m ]"
+   fi
+}
+
+trim() {
+    local var="$*"
+    var="${var#"${var%%[![:space:]]*}"}"   # remove leading whitespace characters
+    var="${var%"${var##*[![:space:]]}"}"   # remove trailing whitespace characters
+    echo -n "$var"
+}
+
+blank_line() {
+   if $terminal ; then
+      echo ""
+   fi
+}
+
+detect_os () {
+
+   if $(which lsb_release > /dev/null 2>&1) ; then
+
+      DIST="$(lsb_release -i | awk '{print tolower($3)}')"
+      DIST_VERSION="$(lsb_release -r | awk '{print tolower($2)}')"
+      DIST_CODENAME="$(lsb_release -c | awk '{print tolower($2)}')"
+
+      if [[ "$DIST" = "debian" ]]; then
+         if $(echo "$DIST_VERSION" | grep -q '\.') ; then
+            DIST_VERSION=$(echo "$DIST_VERSION" | cut --delimiter='.' -f1)
+         fi
+      fi
+
+   elif [[ -e "/etc/os-release" ]]; then
+
+      . /etc/os-release
+
+      DIST=$ID
+      DIST_VERSION=${VERSION_ID}
+
+   fi
+
+   # remove whitespace from DIST and DIST_VERSION
+   DIST="${DIST// /}"
+   DIST_VERSION="${DIST_VERSION// /}"
+
+}
+
+# ----------
+# - Jobhandling
+# ----------
+
+# - Run 'clean_up' for signals SIGHUP SIGINT SIGTERM
+# -
+trap clean_up SIGHUP SIGINT SIGTERM
+
+# - Create lock directory '$LOCK_DIR"
+#
+mkdir "$LOCK_DIR"
+
+blank_line
+
+echononl "Add a cronjob for checking cert.."
+if [[ -f "/var/spool/cron/crontabs/root" ]] ; then
+   if ! grep -i -E "/root/bin/monitoring/check_cert_for_keycloak.sh" /var/spool/cron/crontabs/root > /dev/null 2>&1; then
+      installation_failed=false
+      crontab -l > /tmp/tmp_crontab 2> $log_file
+      if [[ "$?" -ne 0 ]] ; then
+         installation_failed=true
+      fi
+
+      cat << EOF >> /tmp/tmp_crontab 2>> $log_file
+
+# Check if cert for Keycloak service is up-to-date
+#
+51 05 * * * /root/bin/monitoring/check_cert_for_keycloak.sh
+EOF
+      if [[ "$?" -ne 0 ]] ; then
+         installation_failed=true
+      fi
+      crontab /tmp/tmp_crontab > /dev/null 2>> $log_file
+      if [[ "$?" -ne 0 ]] ; then
+         installation_failed=true
+      fi
+      rm /tmp/tmp_crontab  > /dev/null 2>> $log_file
+      if [[ "$?" -ne 0 ]] ; then
+         installation_failed=true
+      fi
+      if ! $installation_failed ; then
+         echo_ok
+      else
+         echo_failed
+         error "Adding cronjob for checking cert failed!"
+      fi
+   else
+      echo_skipped
+   fi
+fi
+
+clean_up 0

conf/keycloak.conf.sample

@@ -0,0 +1,108 @@
+#--------------------------------------
+# Settings for Keycloak Install scripts
+#--------------------------------------
+
+# FQHN_HOSTNAME
+#
+# The full qualified histname under which bbb service
+# is available
+#
+# Defaults to full qualified hostname of the system
+#
+#FQHN_HOSTNAME=""
+
+
+# KEYCLOAK_USER
+#
+# The user under which Keycloak service is running.
+#
+# Defaults to: KEYCLOAK_USER="keycloak"
+#
+#KEYCLOAK_USER=""
+
+
+# KEYCLOAK_GROUP
+#
+# The group of the keycloak user.
+#
+#
+#KEYCLOAK_GROUP=""
+
+
+# KEYCLOAK_BASE_INSTALL_PATH
+#
+# Base directora in which the keycloak installation lives.
+#
+# Defaults to: KEYCLOAK_BASE_INSTALL_PATH="/opt"
+#
+#KEYCLOAK_BASE_INSTALL_PATH="/opt"
+
+
+# DB_TYPE
+#
+# Type of Keycloak database
+#
+# Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
+#
+# Defaults to POSTFIX_DB_TYPE="pgsql"
+#
+# DB_TYPE="pgsql"
+
+
+# MYSQL_CREDENTIAL_ARGS
+#
+# Giving password on command line is insecure an sind mysql 5.5
+# you will get a warning doing so.
+#
+# Reading username/password fro file ist also possible, using MySQL/MariaDB
+# commandline parameter '--defaults-file'.
+#
+# Since Version 5.6, that method is considered as insecure.
+# To avoid giving the password on command line, we use an
+# encrypted option file
+#
+#    Create (encrypted) option file:
+#    $ mysql_config_editor set --login-path=local --socket=/var/run/mysqld/mysqld.sock  --user=backup --password
+#    $ Password:
+#
+#    Use of option file:
+#    $ mysql --login-path=local ...
+#
+# Example
+#    MYSQL_CREDENTIAL_ARGS="--login-path=local"
+#    MYSQL_CREDENTIAL_ARGS="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
+#    MYSQL_CREDENTIAL_ARGS="--defaults-file=/usr/local/mysql/sys-maint.cnf"
+#
+#    # MariaDB 10.4.x
+#    MYSQL_CREDENTIAL_ARGS="-u root -S /tmp/mysql.sock"
+#
+# Defaults to MYSQL_CREDENTIAL_ARGS="-u root -S /tmp/mysql.sock"
+#
+#MYSQL_CREDENTIAL_ARGS="--login-path=local"
+
+
+# DB_NAME
+#
+# Database Name of Mattemost's Database
+#
+# Defaults to: DB_NAME="keycloak"
+#
+#DB_NAME="keycloak"
+
+# DB_USER
+#
+# Database USER of Mattemost's Database
+#
+# Defaults to: DB_USER="keycloak"
+#
+#DB_USER="keycloak"
+
+
+# DB_PASS
+#
+# Database Password used for Mattemost's Database
+#
+# Defaults to a random created one.
+#
+#DB_PASS=""
+