Skip to content

Commit b2e59b8

Browse files
ryanrichter94ryanrichter94
authored
Merge pull request #293 from chocolatey/hardenNexusOperations
Brings QSG into line with Environments Projects
2 parents a766e45 + df2af33 commit b2e59b8

35 files changed

Lines changed: 1417 additions & 2634 deletions

Start-C4bSetup.ps1 renamed to Initialize-C4bSetup.ps1

Lines changed: 111 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,14 @@ C4B Quick-Start Guide initial bootstrap script
1010
- Setup of local `choco-setup` directories
1111
- Download of Chocolatey packages required for setup
1212
#>
13-
[CmdletBinding(DefaultParameterSetName="Attended")]
13+
[CmdletBinding(DefaultParameterSetName = 'Prepare')]
1414
param(
1515
# Full path to Chocolatey license file.
1616
# Accepts any file, and moves and renames it correctly.
1717
# You can either define this as a parameter, or
1818
# script will prompt you for it.
1919
# Script will also validate expiry.
20-
[Parameter(ParameterSetName='Unattended')]
21-
[Parameter(ParameterSetName='Attended')]
20+
[Parameter(ParameterSetName = 'Install')]
2221
[string]
2322
$LicenseFile = $(
2423
if (Test-Path $PSScriptRoot\files\chocolatey.license.xml) {
@@ -41,49 +40,70 @@ param(
4140
}
4241
),
4342

44-
# Unattended mode. Allows you to skip running the other scripts indiviually.
45-
[Parameter(Mandatory, ParameterSetName='Unattended')]
46-
[switch]
47-
$Unattend,
48-
4943
# Specify a credential used for the ChocolateyManagement DB user.
50-
# Only required in Unattend mode for the CCM setup script.
44+
# Only required in install mode for the CCM setup script.
5145
# If not populated, the script will prompt for credentials.
52-
[Parameter(ParameterSetName='Unattended')]
46+
[Parameter(ParameterSetName = 'Install')]
5347
[System.Management.Automation.PSCredential]
5448
$DatabaseCredential = $(
55-
if ($PSCmdlet.ParameterSetName -eq 'Unattended') {
56-
$Wshell = New-Object -ComObject Wscript.Shell
57-
$null = $Wshell.Popup('You will now create a credential for the ChocolateyManagement DB user, to be used by CCM (document this somewhere).')
58-
Get-Credential -UserName ChocoUser -Message 'Create a credential for the ChocolateyManagement DB user'
49+
if ((Test-Path C:\choco-setup\clixml\chocolatey-for-business.xml) -and (Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).DatabaseUser) {
50+
(Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).DatabaseUser
51+
} elseif ($PSCmdlet.ParameterSetName -eq 'Install') {
52+
[PSCredential]::new(
53+
"chocodbuser",
54+
(ConvertTo-SecureString "$(New-Guid)-$(New-Guid)" -Force -AsPlainText)
55+
)
5956
}
6057
),
6158

6259
# The certificate thumbprint that identifies the target SSL certificate in
6360
# the local machine certificate stores.
64-
# Only used in Unattend mode for the SSL setup script.
65-
[Parameter(ParameterSetName='Unattended')]
61+
# Only used in install mode for the SSL setup script.
62+
[Parameter(ParameterSetName = 'Install')]
6663
[ArgumentCompleter({
67-
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
68-
[System.Management.Automation.CompletionResult]::new(
69-
$_.Thumbprint,
70-
$_.Thumbprint,
71-
"ParameterValue",
72-
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
73-
)
64+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
65+
[System.Management.Automation.CompletionResult]::new(
66+
$_.Thumbprint,
67+
$_.Thumbprint,
68+
"ParameterValue",
69+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$", '${FQDN}')
70+
)
71+
}
72+
})]
73+
[string]
74+
$Thumbprint = $(
75+
if ((Test-Path C:\choco-setup\clixml\chocolatey-for-business.xml) -and (Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).CertThumbprint) {
76+
(Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).CertThumbprint
77+
} else {
78+
Get-ChildItem Cert:\LocalMachine\TrustedPeople -Recurse | Sort-Object {
79+
$_.Issuer -eq $_.Subject # Prioritise any certificates above self-signed
80+
} | Select-Object -ExpandProperty Thumbprint -First 1
7481
}
75-
})]
82+
),
83+
84+
# If using a wildcard certificate, provide a DNS name you want to use to access services secured by the certificate.\
85+
[Parameter(ParameterSetName = 'Install')]
86+
[Alias("FQDN")]
7687
[string]
77-
$Thumbprint,
88+
$CertificateDnsName = $(
89+
if ((Test-Path C:\choco-setup\clixml\chocolatey-for-business.xml) -and (Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).CertSubject) {
90+
(Import-Clixml C:\choco-setup\clixml\chocolatey-for-business.xml).CertSubject
91+
}
92+
),
7893

7994
# If provided, shows all Chocolatey output. Otherwise, blissful quiet.
80-
[switch]$ShowChocoOutput,
95+
[switch]
96+
$ShowChocoOutput,
8197

8298
# The branch or Pull Request to download the C4B setup scripts from.
8399
# Defaults to main.
84-
[string]
85100
[Alias('PR')]
86-
$Branch = $env:CHOCO_QSG_BRANCH
101+
[string]
102+
$Branch = $env:CHOCO_QSG_BRANCH,
103+
104+
# If provided, will skip launching the browser at the end of setup.
105+
[Parameter(ParameterSetName = 'Install')]
106+
[switch]$SkipBrowserLaunch
87107
)
88108
if ($ShowChocoOutput) {
89109
$global:PSDefaultParameterValues["Invoke-Choco:InformationAction"] = "Continue"
@@ -102,7 +122,7 @@ $QsRepo = if ($Branch) {
102122
}
103123

104124
$DefaultEap, $ErrorActionPreference = $ErrorActionPreference, 'Stop'
105-
Start-Transcript -Path "$env:SystemDrive\choco-setup\logs\Start-C4bSetup-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
125+
Start-Transcript -Path "$env:SystemDrive\choco-setup\logs\Initialize-C4bSetup-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
106126

107127
try {
108128
# Setup initial choco-setup directories
@@ -114,7 +134,7 @@ try {
114134
$TestDir = Join-Path $ChocoPath "tests"
115135
$xmlDir = Join-Path $ChocoPath "clixml"
116136

117-
@($ChocoPath, $FilesDir, $PkgsDir, $TempDir, $TestDir,$xmlDir) | ForEach-Object {
137+
@($ChocoPath, $FilesDir, $PkgsDir, $TempDir, $TestDir, $xmlDir) | ForEach-Object {
118138
$null = New-Item -Path $_ -ItemType Directory -Force -ErrorAction Stop
119139
}
120140

@@ -132,7 +152,7 @@ try {
132152
# Add the Module Path and Import Helper Functions
133153
if (-not (Get-Module C4B-Environment -ListAvailable)) {
134154
if ($env:PSModulePath.Split(';') -notcontains "$FilesDir\modules") {
135-
[Environment]::SetEnvironmentVariable("PSModulePath", "$env:PSModulePath;$FilesDir\modules" ,"Machine")
155+
[Environment]::SetEnvironmentVariable("PSModulePath", "$env:PSModulePath;$FilesDir\modules" , "Machine")
136156
$env:PSModulePath = [Environment]::GetEnvironmentVariables("Machine").PSModulePath
137157
}
138158
}
@@ -144,30 +164,73 @@ try {
144164

145165
& $FilesDir\OfflineInstallPreparation.ps1 -LicensePath $LicenseFile
146166

147-
if (Test-Path $FilesDir\files\*.nupkg) {
148-
Invoke-Choco source add --name LocalChocolateySetup --source $FilesDir\files\ --Priority 1
149-
}
167+
# Kick off unattended running of remaining setup scripts, if we're running from a saved-script.
168+
if ($PSScriptRoot -or $PSCmdlet.ParameterSetName -eq 'Install') {
169+
Update-Clixml -Properties @{
170+
InitialDeployment = Get-Date
171+
}
150172

151-
# Set Choco Server Chocolatey Configuration
152-
Invoke-Choco feature enable --name="'excludeChocolateyPackagesDuringUpgradeAll'"
153-
Invoke-Choco feature enable --name="'usePackageHashValidation'"
173+
if ($Thumbprint) {
174+
Set-ChocoEnvironmentProperty CertThumbprint $Thumbprint
175+
176+
if ($CertificateDnsName) {
177+
Set-ChocoEnvironmentProperty CertSubject $CertificateDnsName
178+
}
179+
180+
# Collect current certificate configuration
181+
$Certificate = Get-Certificate -Thumbprint $Thumbprint
182+
Copy-CertToStore -Certificate $Certificate
183+
184+
$null = Test-CertificateDomain -Thumbprint $Thumbprint
185+
} elseif ($PSScriptRoot) {
186+
# We're going to be using a self-signed certificate
187+
if (-not $CertificateDnsName) {
188+
$CertificateDnsName = $env:ComputerName
189+
}
190+
191+
$CertificateArgs = @{
192+
CertStoreLocation = "Cert:\LocalMachine\My"
193+
KeyUsage = "KeyEncipherment", "DigitalSignature"
194+
DnsName = $CertificateDnsName
195+
NotAfter = (Get-Date).AddYears(10)
196+
}
197+
198+
$Certificate = New-SelfSignedCertificate @CertificateArgs
199+
Copy-CertToStore -Certificate $Certificate
200+
201+
$Thumbprint = $Certificate.Thumbprint
202+
203+
Set-ChocoEnvironmentProperty CertThumbprint $Thumbprint
204+
Set-ChocoEnvironmentProperty CertSubject $CertificateDnsName
205+
}
154206

155-
# Convert license to a "choco-license" package, and install it locally to test
156-
Write-Host "Creating a 'chocolatey-license' package, and testing install." -ForegroundColor Green
157-
Set-Location $FilesDir
158-
.\scripts\Create-ChocoLicensePkg.ps1
159-
Remove-Item "$env:SystemDrive\choco-setup\packaging" -Recurse -Force
207+
if ($DatabaseCredential) {
208+
Set-ChocoEnvironmentProperty DatabaseUser $DatabaseCredential
209+
}
210+
211+
if (Test-Path $FilesDir\files\*.nupkg) {
212+
Invoke-Choco source add --name LocalChocolateySetup --source $FilesDir\files\ --Priority 1
213+
}
214+
215+
# Set Choco Server Chocolatey Configuration
216+
Invoke-Choco feature enable --name="'excludeChocolateyPackagesDuringUpgradeAll'"
217+
Invoke-Choco feature enable --name="'usePackageHashValidation'"
218+
219+
# Convert license to a "choco-license" package, and install it locally to test
220+
Write-Host "Creating a 'chocolatey-license' package, and testing install." -ForegroundColor Green
221+
Set-Location $FilesDir
222+
.\scripts\Create-ChocoLicensePkg.ps1
223+
Remove-Item "$env:SystemDrive\choco-setup\packaging" -Recurse -Force
160224

161-
# Kick off unattended running of remaining setup scripts.
162-
if ($Unattend) {
163225
$Certificate = @{}
164-
if ($Thumbprint) {$Certificate.Thumbprint = $Thumbprint}
226+
if ($Thumbprint) { $Certificate.Thumbprint = $Thumbprint }
165227

166228
Set-Location "$env:SystemDrive\choco-setup\files"
167-
.\Start-C4BNexusSetup.ps1
229+
.\Start-C4BNexusSetup.ps1 @Certificate
168230
.\Start-C4bCcmSetup.ps1 @Certificate -DatabaseCredential $DatabaseCredential
169-
.\Start-C4bJenkinsSetup.ps1
170-
.\Set-SslSecurity.ps1 @Certificate
231+
.\Start-C4bJenkinsSetup.ps1 @Certificate
232+
233+
Complete-C4bSetup -SkipBrowserLaunch:$SkipBrowserLaunch
171234
}
172235
} finally {
173236
$ErrorActionPreference = $DefaultEap

0 commit comments

Comments
 (0)