<commit_before>#!/usr/bin/env bash
# Exit on first error
set -e

# Define and run our provisioners
# TODO: Add missing tests for apt's update timestamp
apt_provisioner() {
  # If we haven't updated apt-get, then update it now
  # TODO: Use timestamp to update it on a schedule (e.g. 1 day)
  #   https://github.com/twolfson/twolfson.com-scripts/blob/150de4af2778e577ca3d57dab74b6dd7a0e1a55f/bin/bootstrap.sh#L6-L14
  # TODO: Maybe build a function like `update_apt_get` used by other functions?
  if ! test -f .updated-apt-get; then
    sudo apt-get update
    touch .updated-apt-get
  fi
}
apt_provisioner

system_provisioner() {
  # If the timezone isn't as we expect, then update it now
  # https://www.digitalocean.com/community/questions/how-to-change-the-timezone-on-ubuntu-14
  # http://serverfault.com/a/84528
  if test "$(date +"%z")" != "+0000"; then
    sudo chown root:root "$data_dir/etc/timezone"
    sudo chmod u=rw,g=r,o=r "$data_dir/etc/timezone"
    sudo cp --preserve "$data_dir/etc/timezone" /etc/timezone
    sudo dpkg-reconfigure --frontend noninteractive tzdata
  fi
}
system_provisioner

# TODO: Add missing tests for users provisioner
users_provisioner_ubuntu() {
  # If there is no ubuntu user, then create them
  # DEV: Digital Ocean's Ubuntu images provision us as the root user so we must create an ubuntu user
  # https://github.com/mizzy/specinfra/blob/v2.47.0/lib/specinfra/command/base/user.rb#L3-L5
  # https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-14-04
  # https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file-on-ubuntu-and-centos
  if ! id ubuntu &> /dev/null; then
    # Create password-less `ubuntu` user with metadata "Ubuntu"
    adduser ubuntu --disabled-password --gecos "Ubuntu"

    # Add ubuntu user to sudo group (sudoers will be performed later)
    gpasswd -a ubuntu sudo

    # Create a folder for SSH configuration
    mkdir --mode u=rwx,g=,o= /home/ubuntu/.ssh
    chown ubuntu:ubuntu /home/ubuntu/.ssh
    chmod u=rwx,g=,o= /home/ubuntu/.ssh
  fi

  # if there is no sudoers set up for the `ubuntu` user, then set it up
  # DEV: We keep this separate from `gpasswd` to run this for Travis CI
  if ! test -f /etc/sudoers.d/ubuntu; then
    sudo chown root:root "$data_dir/etc/sudoers.d/ubuntu"
    sudo chmod u=r,g=,o= "$data_dir/etc/sudoers.d/ubuntu"
    sudo cp --preserve "$data_dir/etc/sudoers.d/ubuntu" /etc/sudoers.d/ubuntu
  fi
}
users_provisioner_ubuntu

# @depends_on: users_provisioner_ubuntu # For ubuntu user
ssh_provisioner_authorized_keys() {
  # Update authorized keys
  # DEV: This won't brick Vagrant since it uses a `vagrant` user for ssh
  sudo chown ubuntu:ubuntu "$data_dir/home/ubuntu/.ssh/authorized_keys"
  sudo chmod u=rw,g=,o= "$data_dir/home/ubuntu/.ssh/authorized_keys"
  sudo cp --preserve "$data_dir/home/ubuntu/.ssh/authorized_keys" /home/ubuntu/.ssh/authorized_keys
  # WARNING: THIS WILL LOCK OUT THE ROOT USER
  sudo chmod u=rwx,g=,o= "/root/.ssh"
  sudo chown root:root "$data_dir/root/.ssh/authorized_keys"
  sudo chmod u=rw,g=,o= "$data_dir/root/.ssh/authorized_keys"
  sudo cp --preserve "$data_dir/root/.ssh/authorized_keys" /root/.ssh/authorized_keys
}
ssh_provisioner_authorized_keys

# @depends_on: ssh_provisioner_authorized_keys # To prevent locking out root without ubuntu user being setup
users_provisioner_shells() {
  # If the root user has a non-nologin login shell, update it
  # https://github.com/mizzy/specinfra/blob/v2.44.7/lib/specinfra/command/base/user.rb#L53-L55
  # https://github.com/mizzy/specinfra/blob/v2.44.7/lib/specinfra/command/base/user.rb#L61-L63
  if test "$(getent passwd root | cut -f 7 -d ":")" != "/usr/sbin/nologin"; then
    sudo usermod --shell /usr/sbin/nologin root
  fi

  # If the sync user has a non-nologin login shell, update it
  # DEV: The sync user exists to run `sync` on a server without needing to use a shell
  #   However, we are going to be paranoid and remove it
  # http://www.unix.com/fedora/167621-user-sync-shutdown.html
  if test "$(getent passwd sync | cut -f 7 -d ":")" != "/usr/sbin/nologin"; then
    sudo usermod --shell /usr/sbin/nologin sync
  fi
}

# @depends_on: ssh_provisioner_authorized_keys # To prevent locking out root and ubuntu user concurrently
ssh_provisioner_config() {
  # Update sshd config
  # WARNING: THIS WILL LOCK OUT THE ROOT USER
  # TODO: Find conditional to handle this
  sudo chown root:root "$data_dir/etc/ssh/sshd_config"
  sudo chmod u=rw,g=r,o=r "$data_dir/etc/ssh/sshd_config"
  sudo cp --preserve "$data_dir/etc/ssh/sshd_config" /etc/ssh/sshd_config

  # Reload our SSH server
  # http://unix.stackexchange.com/a/127887
  sudo service ssh reload
}

# @depends_on: apt_provisioner<commit_msg>Added missing invocations for provisioners<commit_after>#!/usr/bin/env bash
# Exit on first error
set -e

# Define and run our provisioners
# TODO: Add missing tests for apt's update timestamp
apt_provisioner() {
  # If we haven't updated apt-get, then update it now
  # TODO: Use timestamp to update it on a schedule (e.g. 1 day)
  #   https://github.com/twolfson/twolfson.com-scripts/blob/150de4af2778e577ca3d57dab74b6dd7a0e1a55f/bin/bootstrap.sh#L6-L14
  # TODO: Maybe build a function like `update_apt_get` used by other functions?
  if ! test -f .updated-apt-get; then
    sudo apt-get update
    touch .updated-apt-get
  fi
}
apt_provisioner

system_provisioner() {
  # If the timezone isn't as we expect, then update it now
  # https://www.digitalocean.com/community/questions/how-to-change-the-timezone-on-ubuntu-14
  # http://serverfault.com/a/84528
  if test "$(date +"%z")" != "+0000"; then
    sudo chown root:root "$data_dir/etc/timezone"
    sudo chmod u=rw,g=r,o=r "$data_dir/etc/timezone"
    sudo cp --preserve "$data_dir/etc/timezone" /etc/timezone
    sudo dpkg-reconfigure --frontend noninteractive tzdata
  fi
}
system_provisioner

# TODO: Add missing tests for users provisioner
users_provisioner_ubuntu() {
  # If there is no ubuntu user, then create them
  # DEV: Digital Ocean's Ubuntu images provision us as the root user so we must create an ubuntu user
  # https://github.com/mizzy/specinfra/blob/v2.47.0/lib/specinfra/command/base/user.rb#L3-L5
  # https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-14-04
  # https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file-on-ubuntu-and-centos
  if ! id ubuntu &> /dev/null; then
    # Create password-less `ubuntu` user with metadata "Ubuntu"
    adduser ubuntu --disabled-password --gecos "Ubuntu"

    # Add ubuntu user to sudo group (sudoers will be performed later)
    gpasswd -a ubuntu sudo

    # Create a folder for SSH configuration
    mkdir --mode u=rwx,g=,o= /home/ubuntu/.ssh
    chown ubuntu:ubuntu /home/ubuntu/.ssh
    chmod u=rwx,g=,o= /home/ubuntu/.ssh
  fi

  # if there is no sudoers set up for the `ubuntu` user, then set it up
  # DEV: We keep this separate from `gpasswd` to run this for Travis CI
  if ! test -f /etc/sudoers.d/ubuntu; then
    sudo chown root:root "$data_dir/etc/sudoers.d/ubuntu"
    sudo chmod u=r,g=,o= "$data_dir/etc/sudoers.d/ubuntu"
    sudo cp --preserve "$data_dir/etc/sudoers.d/ubuntu" /etc/sudoers.d/ubuntu
  fi
}
users_provisioner_ubuntu

# @depends_on: users_provisioner_ubuntu # For ubuntu user
ssh_provisioner_authorized_keys() {
  # Update authorized keys
  # DEV: This won't brick Vagrant since it uses a `vagrant` user for ssh
  sudo chown ubuntu:ubuntu "$data_dir/home/ubuntu/.ssh/authorized_keys"
  sudo chmod u=rw,g=,o= "$data_dir/home/ubuntu/.ssh/authorized_keys"
  sudo cp --preserve "$data_dir/home/ubuntu/.ssh/authorized_keys" /home/ubuntu/.ssh/authorized_keys
  # WARNING: THIS WILL LOCK OUT THE ROOT USER
  sudo chmod u=rwx,g=,o= "/root/.ssh"
  sudo chown root:root "$data_dir/root/.ssh/authorized_keys"
  sudo chmod u=rw,g=,o= "$data_dir/root/.ssh/authorized_keys"
  sudo cp --preserve "$data_dir/root/.ssh/authorized_keys" /root/.ssh/authorized_keys
}
ssh_provisioner_authorized_keys

# @depends_on: ssh_provisioner_authorized_keys # To prevent locking out root without ubuntu user being setup
users_provisioner_shells() {
  # If the root user has a non-nologin login shell, update it
  # https://github.com/mizzy/specinfra/blob/v2.44.7/lib/specinfra/command/base/user.rb#L53-L55
  # https://github.com/mizzy/specinfra/blob/v2.44.7/lib/specinfra/command/base/user.rb#L61-L63
  if test "$(getent passwd root | cut -f 7 -d ":")" != "/usr/sbin/nologin"; then
    sudo usermod --shell /usr/sbin/nologin root
  fi

  # If the sync user has a non-nologin login shell, update it
  # DEV: The sync user exists to run `sync` on a server without needing to use a shell
  #   However, we are going to be paranoid and remove it
  # http://www.unix.com/fedora/167621-user-sync-shutdown.html
  if test "$(getent passwd sync | cut -f 7 -d ":")" != "/usr/sbin/nologin"; then
    sudo usermod --shell /usr/sbin/nologin sync
  fi
}
users_provisioner_shells

# @depends_on: ssh_provisioner_authorized_keys # To prevent locking out root and ubuntu user concurrently
ssh_provisioner_config() {
  # Update sshd config
  # WARNING: THIS WILL LOCK OUT THE ROOT USER
  # TODO: Find conditional to handle this
  sudo chown root:root "$data_dir/etc/ssh/sshd_config"
  sudo chmod u=rw,g=r,o=r "$data_dir/etc/ssh/sshd_config"
  sudo cp --preserve "$data_dir/etc/ssh/sshd_config" /etc/ssh/sshd_config

  # Reload our SSH server
  # http://unix.stackexchange.com/a/127887
  sudo service ssh reload
}
ssh_provisioner_config

# @depends_on: apt_provisioner
{'fraction_non_alphanumeric': 0.11716706768490427, 'fraction_numerical': 0.01611047180667434, 'mean_word_length': 3.791979949874687, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 14, 'lorem ipsum': 0, 'www.': 8, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4282052', 'n_tokens_mistral': 3814, 'n_tokens_neox': 3365, 'n_words': 915}